External risk intelligence

Jpom Authentication Bypass Via JPOM-USER-TOKEN Header

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120201

Jpom is a project monitoring and deployment management platform typically deployed as an externally accessible web service or management dashboard. Because it provides administrative control over server scripts and application management, it is commonly exposed to the network to facilitate remote management, placing it in the category of likely internet-facing management services.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Jpom software could allow unauthorized individuals to gain full administrative control of affected systems without needing any credentials. This is achieved by exploiting a flaw in how the system processes a specific header, potentially enabling command execution.

Unauthenticated access to critical functions.
Significant risk of system compromise.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted request to a Jpom server. The request would target the JPOM-USER-TOKEN header, manipulating it with specially formatted query conditions. This allows the attacker to bypass authentication and gain elevated privileges, potentially leading to unauthorized command execution.

No authentication or special access required.
Injecting query conditions into a header.
Gaining super-administrator access and running commands.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication and gain super-administrator access to Jpom systems. When supported by the advisory, this access could be used to execute commands, potentially affecting system integrity and service availability.

System access and command execution.
Unauthenticated injection into a header field.
Compromised system and data availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Jpom platform's authentication bypass vulnerability requires immediate attention from teams managing its deployment. The first step is to ascertain the presence and reachability of Jpom instances, identify their business criticality, and determine the accountable ownership for remediation planning.

Ownership: Platform or application teams.
Verify first: Jpom instance presence and exposure.
Action: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Jpom and what is it used for?

Jpom is an open-source project monitoring and deployment management platform. Developers and system administrators use it as a centralized dashboard to manage server scripts, monitor application status, and handle deployment tasks efficiently across different environments.

What does CVE-2026-120201 mean for Jpom security?

This vulnerability is classified as Improper Neutralization of Special Elements in Data Query Logic (CWE-943). It means the system fails to correctly validate input in a specific header, allowing a malicious actor to trick the application into granting full super-administrator privileges without any valid credentials.

How is this authentication bypass triggered?

An attacker triggers this by sending a specially crafted JPOM-USER-TOKEN header containing specific query conditions, such as 'is not null'. Because the system's underlying parser misinterprets this input as a command rather than simple text, the authentication check is bypassed. This does not require prior user access or knowledge of valid accounts.

Why should I care about this Jpom vulnerability?

According to Halo Surface Signal, Jpom is often deployed as an internet-facing management service to enable remote control. If your instance is reachable over the network, attackers can leverage this flaw to gain unauthorized administrative access, which may include the ability to execute arbitrary commands on your server.

What are the first steps to address this issue?

Begin by auditing your environment to locate all running Jpom instances and confirm whether they are accessible over the network. Once you have identified these assets, evaluate their business criticality and coordinate with the relevant team owners to prioritize remediation and limit external exposure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.