The vulnerability arises from a hard‑coded cryptographic key that is embedded in BillionMail’s configuration. Because the key is deterministic, an attacker can compute the signature expected by the application and generate valid JSON Web Tokens that control subscription operations. This flaw allows an unauthenticated user to create tokens that instruct the API to unsubscribe a contact or confirm a subscription, effectively bypassing the intended authorization checks. The weakness corresponds to CWE‑1394, an unauthorized privilege escalation through request manipulation.

Affected are versions of aaPanel’s BillionMail service up to and including 4.9. All releases that ship the default signing key in the configuration file are vulnerable, and any installation that has not upgraded past 4.9 remains susceptible. The vulnerability has no dependency on platform or deployment specifics beyond the presence of the default key.

With a CVSS score of 6.9 the flaw represents a moderate severity condition. The EPSS score of < 1% and its absence from CISA KEV indicate that, so far, commercial exploitation has not been widely observed, but the attack path is trivial: a network adversary can construct a forged JWT offline and submit it to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm. Because no authentication is required and the token can be generated deterministically, the exploit is considered feasible with minimal effort.