A hardcoded HS256 signing key allows an attacker to create valid JSON Web Tokens containing a superUser flag and any group identifiers. The forged token can be presented to any protected endpoint, enabling an unauthenticated user to obtain super administrator privileges across the entire vlife interface, thereby compromising confidentiality, integrity, and availability of all application data.

The vulnerability affects vlife installations up to and including version 2.0.1. Users operating these releases are exposed, regardless of deployment size or environment, as the back‑end logic is baked into the core library rather than configurable.

The assigned CVSS score of 9.3 indicates a critical risk. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation, but the fact that the flaw is exploitable with no prerequisites and has no public exploit repository does not reduce its danger. Because the weak secret is embedded in the code, the attack vector is remote over HTTP/HTTPS, and the impact is on all users facing the application. The vulnerability is not listed in the CISA KEV catalog, but its severity warrants urgent attention.