Simple Admin Core 1.8.7 Allows Unauthenticated Super Admin Token Forgery

An unauthenticated attacker can seize complete administrative control of a Simple Admin Core instance by forging a super administrator token. This capability exists in versions through 1.8.7 because the application uses a hard-coded secret for signing JSON Web Tokens. The vulnerability, tracked as CVE-2026-111690, is rated Critical with a CVSS score of 9.3 by the National Vulnerability Database.

In plain English

The application uses a secret key to create digital signatures that prove a user is who they claim to be. In this case, that secret key is written directly into the software’s configuration file. Because the key is known and static, anyone can use it to create a fake signature. The attacker does not need to steal a password or guess a login. They simply generate a token that the system accepts as valid because it matches the expected signature.

The background

The National Vulnerability Database records this issue under CWE-321, which covers issues related to hard-coded credentials or secrets. The specific file involved is api/etc/core.yaml, which contains the Auth.AccessSecret value. An attacker uses this public secret to sign a JWT with a specific roleId claim of 001. This specific claim value corresponds to the super administrator role within the Simple Admin Core architecture.

What changes now

Once the forged token is accepted, the attacker gains full administrative control over the entire system. This includes the ability to manage users, modify roles, change menu structures, and alter API authorities. The attacker can also manipulate system configuration and generate new tokens. This level of access effectively allows the intruder to take over the application completely, reading or modifying any data stored within the platform without restriction.

What made it possible

Hard-coded secrets represent a fundamental failure in secret management practices. When credentials are embedded in configuration files or source code, they become accessible to anyone who can read those files. This weakness serves the initial access stage of an intrusion by allowing attackers to bypass authentication entirely. Teams usually rely on centralized secret management systems to ensure keys are unique, rotated regularly, and never exposed in static files. Check whether your deployment uses dynamic secrets instead of static values to prevent token forgery.

What to do and how to stay safe: Simple Admin Core

• Verify if your Simple Admin Core installation is version 1.8.7 or earlier and check the api/etc/core.yaml file for the Auth.AccessSecret value.
• Monitor server logs for unusual token generation activity or requests containing JWTs with the roleId claim of 001 from unknown sources.
• Once the vendor provides an update, apply it immediately to replace the hard-coded secret with a dynamically generated one.
• Review access logs for any unauthorized changes to user roles, API authorities, or system configuration settings that may indicate exploitation.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111690?

The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.3.

Which versions of Simple Admin Core are affected?

All versions of Simple Admin Core through 1.8.7 are affected by this authentication bypass vulnerability.

What specific file contains the vulnerable secret?

The hard-coded Auth.AccessSecret is located in the api/etc/core.yaml configuration file.