SeriaWei ZKEACMS: Authentication bypass via hard-coded JWT signing key
Summary
ZKEACMS through version 4.4 uses a hard-coded HMAC-SHA256 signing key for REST API JWT bearer tokens. An unauthenticated remote attacker can forge a token with the Name claim set to 'admin' and call API endpoints that require authorization. This allows modifying articles and products and reading form submissions.
Affected
- SeriaWei ZKEACMS versions 0 to 4.4 (default configuration)
Fixed in
Unknown.
Workaround
- Restrict access to the API paths at the reverse proxy or WAF to trusted networks or VPN, or take the site offline until a fix is available.
- Check whether the default 'admin' account still exists and change its credentials.
- Review articles, products and form submissions for unexpected changes or exports.
- Treat data reachable through the CMS as potentially exposed until the signing key is changed.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes.
- Public technical material exists (GitHub issue and third-party write-up).
- No evidence of exploitation in the wild found.
Our recommendation
- Check whether any ZKEACMS instance is publicly reachable and which version it runs.
- Restrict the CMS API to trusted networks until a fixed version is available.
- Replace the hard-coded signing key with a random, deployment-specific secret loaded from protected configuration.
- Change the default admin credentials and review logs and content for unauthorized changes.
- Monitor the GitHub issue and vendor channels for an official fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Official CVE record / VulnCheck advisory www.vulncheck.com
- ZKEACMS GitHub issue #531 github.com
- JwtBearerDefaults.cs at v4.4 github.com
- BuilderAuthentication.cs at v4.4 github.com
- VulDB CVE-2026-111633 vuldb.com
- Third-party write-up (HackMD) hackmd.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:01.
Original description (NVD)
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
NVD references (7)
- https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/Api/JwtBearerDefaults.cs#L14-L19
- https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/BuilderAuthentication.cs#L41-L52
- https://github.com/SeriaWei/ZKEACMS/issues/531
- https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass
- https://www.vulncheck.com/advisories/zkeacms-through-4.4-authentication-bypass-via-hard-coded-jwt-signing-key
- https://github.com/SeriaWei/ZKEACMS/issues/531
- https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.