Key points
- Simple Admin Core versions up to and including 1.8.7 contain a critical authentication bypass flaw.
- Attackers can use a public, hard-coded secret to generate super administrator tokens.
- Successful exploitation grants full control over users, roles, menus, and API configuration.
Administrators running Simple Admin Core version 1.8.7 or earlier must address a critical security flaw immediately. The vulnerability, tracked as CVE-2026-111690, carries a CVSS score of 9.3. This high-severity issue allows unauthenticated attackers to bypass login requirements entirely. The flaw stems from a hard-coded authentication secret stored in the application's configuration files. The source material does not confirm the availability of a fix for this version.
In plain English
The application uses a fixed secret key to verify user identity. This key is stored in plain text within the api/etc/core.yaml file. Because the secret is public and unchangeable, anyone can read it. Attackers use this known secret to digitally sign their own access tokens. They set the role ID to 001, which the system recognizes as the super administrator. The application accepts these forged tokens as valid, granting the attacker complete control.
The background
The flaw is categorized under CWE-321, which relates to the use of hard-coded credentials. By embedding the Auth.AccessSecret directly in the code, the developers created a static target. Attackers do not need to steal passwords or exploit complex logic. They simply replicate the signing process using the public key. This allows them to create JWTs that the server trusts implicitly. The result is immediate, full administrative access without any prior interaction with the login system.
What changes now
Users of Simple Admin Core are currently at risk of total system compromise. The vulnerability affects core administrative functions including user management, role assignment, and API authority settings. An attacker can modify configurations, create new accounts, or alter existing permissions. Since the flaw exists in versions through 1.8.7, any installation not updated beyond this point is vulnerable. Organizations must verify their current version and assess exposure immediately.
Who needs to act first
Teams should prioritize systems exposed to the internet or untrusted networks. Check whether external interfaces allow direct API access. Isolate affected instances if immediate remediation is not possible. Review access logs for unusual token generation or administrative changes. Validate that backup procedures are current before making configuration changes. Monitor for signs of unauthorized privilege escalation. Ensure that incident response plans cover full account takeover scenarios. Coordinate with vendors to track patch availability.
What to do and how to stay safe: Simple Admin Core
- Verify your Simple Admin Core version and confirm if it is 1.8.7 or earlier.
- Restrict network access to the application to trusted internal addresses only.
- Monitor server logs for unexpected administrative actions or new token creations.
- Prepare to apply the vendor update once a secure patch becomes available.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111690?
The National Vulnerability Database rates the vulnerability as 9.3, which is critical.
How do attackers exploit this flaw?
They use the hard-coded Auth.AccessSecret from the config file to sign fake admin tokens.
Which versions of Simple Admin Core are affected?
All versions through and including 1.8.7 contain the authentication bypass vulnerability.
