Jpom: Authentication bypass via JPOM-USER-TOKEN header
Summary
Jpom 2.10.0 through 2.11.12 contains an authentication bypass in the JPOM-USER-TOKEN header handling. An unauthenticated attacker can obtain super-administrator access and then execute commands through Jpom's script features. The flaw is caused by query conditions in the header being interpreted by the Hutool parser.
Affected
- Jpom 2.10.0 through 2.11.12 (dromara Jpom)
- Versions before 2.10.0: Unknown.
Fixed in
- Unknown. No fixed release was found at the time of writing.
Workaround
- Restrict access to Jpom to VPN or an internal allowlist; do not expose it directly to the internet.
- Monitor reverse proxy or WAF logs for unusual use of the JPOM-USER-TOKEN header.
- The researcher suggests rotating or expiring token values; this is not a vendor fix and its effectiveness is unconfirmed.
Exploitation
- Public technical details are available in the GitHub issue; the trigger details are omitted here.
- No known exploitation in the wild and no CISA KEV listing found at the time of writing.
- No confirmed public exploit found.
Our recommendation
- Immediately restrict access to Jpom (VPN or internal allowlist) and remove any direct internet exposure.
- Check for unexpected administrator accounts and newly created or modified scripts.
- If the instance was internet-facing while vulnerable, treat it as potentially compromised and rotate credentials for Jpom users and managed servers.
- Check the Jpom releases page regularly and upgrade as soon as a fixed version is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Jpom GitHub issue #121 github.com
- Jpom GitHub repository github.com
- LoginInterceptor.java at v2.11.12 github.com
- VulDB entry 429576 vuldb.com
- OffSeq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:21.
Original description (NVD)
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.