Is CVE-2026-110612 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110612?

CVE-2026-110612 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-110612

Description

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.