The vulnerability in ape‑volo‑admin allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT signing key stored in appsettings.json. By signing a token offline with the jti claim set to the seeded administrator identifier, an attacker can impersonate the system’s administrator and obtain unrestricted access to all API endpoints, including users, roles, permissions and sensitive data. This flaw is classified as a high‑severity authentication bypass (CWE‑1394) and enables an attacker to gain full control over the affected system without needing valid credentials.

Users running xianhc’s ape‑volo‑admin before version 3.6.1 are affected. Versions such as 3.5.2 and earlier include the hardcoded JWT signing key that enables the forgery attack. Any deployment that has not been updated to 3.6.1 or later remains vulnerable.

The CVSS score of 9.3 highlights the critical nature of this flaw, and while EPSS data is not available, the exploitability is straightforward: the attacker merely needs to read the configuration file to obtain the signing key, sign any token offline, and send it to the API. Because the key is embedded in the code, the attack can be performed without additional reconnaissance. The vulnerability is not yet listed in CISA’s KEV catalog, but the easy construction of valid admin tokens and the serious impact make it a high‑priority threat.