External risk intelligence

Simple Admin Core Authentication Bypass via Hardcoded JWT Secret

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111690

The vulnerability exists in an administrative API component. Such services are commonly deployed as internet-facing management interfaces or API gateways to facilitate remote administration and application orchestration, making them frequently accessible from the public internet.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Simple Admin Core, a technology used for system administration. The flaw allows unauthorized individuals to gain complete administrative control by bypassing authentication mechanisms. This could have significant implications for system security and data integrity if exploited.

Unauthenticated users can take full control.
Protects core administrative functions and data.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can bypass authentication by leveraging a hard-coded secret. This allows them to forge administrative tokens, granting them extensive control over the system.

Entry Condition: No authentication required.
Trigger Point: Forging a JWT with a hard-coded secret.
Resulting Risk: Full administrative control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to gain full administrative control over the system by forging super administrator tokens. This could affect user management, API access, and system configurations when the administrative API is exposed externally.

Administrative control and system data.
Unauthenticated token forging via hardcoded secret.
Complete compromise of user and system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical authentication bypass vulnerability in Simple Admin Core impacts systems where the application is deployed and accessible, particularly if exposed externally. System owners and platform teams are likely responsible for identifying and securing these deployments. The first practical step involves discovering where Simple Admin Core is implemented, assessing its reachability and business criticality, locating the specific asset owner, and then planning a risk-based remediation.

Application owners should investigate deployments.
Verify external reachability and business impact.
Plan vendor coordination and updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Simple Admin Core?

Simple Admin Core is a backend framework designed to streamline system management and application development. It provides the infrastructure for handling administrative tasks, such as managing users, defining roles, and configuring API permissions. Developers use it as a foundational component to build and organize the internal logic and security policies of their administrative dashboards.

What does CWE-321 mean for CVE-2026-111690?

CWE-321 refers to the use of a hard-coded cryptographic key. In this vulnerability, Simple Admin Core uses a static, hard-coded secret within its configuration file to sign JSON Web Tokens (JWTs). Because the secret is fixed rather than unique to each installation, anyone who discovers or already knows this value can generate their own valid tokens, effectively tricking the system into granting them super administrator privileges.

How can an attacker trigger this vulnerability?

An attacker can trigger this flaw by crafting a custom JWT using the known, hard-coded secret found in the software's configuration. They must specifically set the role ID claim to '001' to identify as a super administrator. This bug is only triggered by presenting this forged token to the system; simply visiting the application or interacting with non-administrative endpoints without a validly signed token will not cause this specific bypass.

Why is this CVE a priority for my team?

According to Halo Surface Signal, this vulnerability affects an administrative API component often deployed as an internet-facing management interface. Because these interfaces are frequently reachable from the public internet to support remote orchestration, they are prime targets. If your instance of Simple Admin Core is accessible without a VPN or restricted network, the risk of unauthorized administrative access is significantly higher.

Do I need to update my software to fix this?

The first step is to locate all instances of Simple Admin Core within your environment to determine if they are exposed to the network. Once you have identified these assets, verify their business criticality and coordinate with your platform team. You should treat this as a high-priority security configuration issue, prioritize identifying the asset owners, and plan for remediation steps provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.