Blindly using a hard‑coded JWT signing key in BotSharp allows an attacker to forge bearer tokens. By signing the token with the known HMAC secret, the attacker can create a valid token that impersonates any user, including administrators, and bypasses authentication on protected API routes. This is a classic authentication bypass that can lead to privilege escalation, listed as CWE‑321.

The vulnerability affects BotSharp versions up to and including 5.2.0 from SciSharp. The hard‑coded key is stored in the WebStarter appsettings.json file, and the issuer and audience are fixed, enabling token forgery for any known user.

The CVSS score of 9.3 marks it as Critical, with a high exploitation risk. The EPSS is not available, and it is not listed in the CISA KEV catalogue. An unauthenticated remote attacker can fabricate a signed JWT and immediately impersonate privileged users, making this vulnerability exploitable via remote web interfaces that accept bearer tokens.