Simple Admin Core: Authentication bypass via hard-coded JWT secret

Summary

Simple Admin Core through version 1.8.7 ships with a hard-coded JWT signing secret (Auth.AccessSecret) in its default configuration file api/etc/core.yaml. An unauthenticated attacker who knows this public value can sign a JWT with the super administrator role ID and gain full administrative control over users, roles, menus, API permissions, configuration and tokens. No credentials or user interaction are required, so any reachable instance with the default secret is at risk.

Affected

• suyuan32 Simple Admin Core, versions 0 to 1.8.7 (per CNA record)
• Deployments using the default AccessSecret from the example configuration files
• Versions before 1.8.8 are reported as affected by third-party sources; vendor confirmation pending

Fixed in

• Fixed in 1.8.8 or later according to third-party sources (not yet confirmed by the vendor)
• Vendor fix reference: pull request #382 (replaces hard-coded secrets in example configs)

Workaround

• Replace the hard-coded Auth.AccessSecret with a unique secret loaded from an environment variable or secrets store
• Restrict access to the admin API and back-office UI to internal networks or VPN
• No vendor-issued workaround found

Exploitation

• CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total
• Known exploited: No (per sources reviewed)
• A third-party write-up exists; public exploit details could not be verified
• The secret is in the public repository, so exploitation is easy to reproduce

Our recommendation

• Identify all simple-admin-core instances and their versions, including the api/etc/core.yaml files
• Check whether the admin service is reachable from the internet and restrict access if so
• Upgrade to 1.8.8 or later after confirming the fixed release on the vendor's GitHub
• Replace and rotate the JWT access secret, then review admin accounts and tokens for unexpected activity
• Monitor logs for unexpected administrative API requests

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub: core.yaml at v1.8.7 (hard-coded AccessSecret) github.com
• GitHub: Pull Request #382 (secret replacement) github.com
• VulnCheck advisory www.vulncheck.com
• Third-party write-up hackmd.io
• Vulners PT-2026-116089 vulners.com
• VulDB CVE-2026-111690 vuldb.com
• GitHub releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:24.