CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-108860 — BotSharp through 5.2.0 contains an authentication bypass vulnerability that allo...

·Source: NIST NVD

Updated:

Executive Summary

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.

Analysis

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes. CVSS Score: 9.1. Published: 2026-10-11T14:17:05.933.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108860
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 11, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Cryptohack Roundup: Turkey Holds Hex Founder, Seizes $7.15M

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cryptohack-roundup-turkey-detains-hex-founder-seizes-715m-image_small-7-a-33174.jpg" align=right hspace=4><b>Also: Fake Ngrave Alerts Linked to $2.65M Crypto Theft</b><br>This week, Turkish police detained Hex founder Richard Heart, attackers exploited Cysic's bridge to mint unauthorized tokens, fake Ngrave alerts led to $2.65 mil

Bank Info Security
MEDIUMVulnerability

Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. According to multiple reports from the Associated Press, the New York Times, Reuters, and the Wall Street Journal, state District Court Judge Francis J. Mathew called

The Hacker News
MEDIUMVulnerability

How PHP's Coordinated Disclosure Process Went Belly Up

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/how-phps-coordinated-disclosure-process-went-belly-up-image_small-7-a-33176.jpg" align=right hspace=4><b>Open-Source PHP Team Also Admits to Decision Paralysis After 1 Flaw Found in 2024</b><br>The PHP Foundation said its coordinated vulnerability disclosure process for PHP2Shell worked, until it didn't. A demonstration video of a

Bank Info Security