wwwlike vlife: Authentication bypass via hardcoded JWT signing key

Summary

vlife through 2.0.1 uses a hardcoded HS256 signing key in TokenUtil to sign JSON Web Tokens (JWTs). An unauthenticated remote attacker can forge a token with superUser=true and arbitrary groupIds claims and gain super administrator access to any URL of the application. No special conditions beyond network access to the instance are required.

Affected

• wwwlike vlife through 2.0.1 (all versions up to and including 2.0.1)
• Note: one source (ThreatInt) gives conflicting wording on the affected range; the CNA record and other sources list up to 2.0.1.

Fixed in

Unknown. No vendor advisory or fixed release was found at the time of writing.

Workaround

• Remove vlife instances from direct internet exposure; allow access only through a VPN or an access-restricted reverse proxy.
• Restrict access to known IP addresses where possible.
• No vendor-provided workaround is known.

Exploitation

• CISA SSVC assessment: exploitation status 'poc', automatable: yes, technical impact: total.
• A public proof of concept may exist; this could not be fully verified.
• No confirmed exploitation in the wild found; not listed in CISA KEV at the time of writing.
• EPSS score at time of research: 0.00995.

Our recommendation

• Check whether any vlife instance is deployed in your environment, including unmanaged or forked builds.
• If an instance exists and is reachable from untrusted networks, isolate it immediately behind a VPN or restricted proxy.
• Replace the hardcoded signing key with a long random secret loaded from configuration or environment variables; note that this invalidates existing tokens.
• Review authentication and admin logs for unexpected activity since 14 October 2026.
• Monitor for a vendor fix and apply it as soon as it is available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory for CVE-2026-110612 www.vulncheck.com
• HackMD write-up on hardcoded JWT secret hackmd.io
• Vulnerable code: TokenUtil.java github.com
• VulDB entry for CVE-2026-110612 vuldb.com
• GitHub repository wwwlike/vlife github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:10.