The vulnerability originates from a hard-coded JWT signing key, issuer, and audience specified in appsettings.json. Because the token validator trusts these values, attackers can forge JWTs for any user ID and role, effectively bypassing authentication and gaining administrator privileges across the entire API.

The affected product is Asp.Net‑Core‑Inventory‑Order‑Management‑System developed by go2ismail. All releases prior to v10.20261109 are vulnerable; the 10.20261109 release and later are believed to contain the necessary fix.

With a CVSS score of 9.3 the vulnerability is considered critical. No EPSS data is available and the issue is not currently listed in the CISA KEV catalog. The attack vector is remote and requires no prior authentication; any unauthenticated attacker who can reach the API can forge a token and impersonate an administrator.