ZKEACMS vulnerabilities

CVEs whose affected-version data names the ZKEACMS package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111633High· 8.6

yesterday

ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token …

▾ TwilightSeriaWei · ZKEACMSvia CVEORG