---
id: CVE-2026-110612
title: >-
  vlife through 2.0.1 contains an authentication bypass vulnerability that
  allows unauthenticated attackers to forge JWTs using the hardcoded HS256
  signing key in TokenUtil
summary: >-
  vlife through 2.0.1 contains an authentication bypass vulnerability that
  allows unauthenticated attackers to forge JWTs using the hardcoded HS256
  signing key in TokenUtil. Attackers can sign a token with superUser=true and
  arbitrary grou…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-321
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T18:17:34.803'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110612'
references:
  - url: 'https://github.com/wwwlike/vlife'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-base/src/main/java/cn/wwwlike/config/VlifeUrlDecisionManager.java#L25
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-boot-starter-web/src/main/java/cn/wwwlike/web/security/filter/TokenUtil.java#L33-L58
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vlife-through-2.0.1-authentication-bypass-via-hardcoded-jwt-secret-in-tokenutil
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.005Z'
---

## Overview

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.