BotSharp 5.2.0 has critical auth bypass via hardcoded JWT key
An unauthenticated remote attacker can forge bearer tokens in BotSharp through version 5.2.0 using a hardcoded secret in the WebStarter configuration file.
Key points
- CVE-2026-108860 is rated critical with a CVSS score of 9.3.
- The flaw allows impersonation of any user, including administrators.
- Affected versions include all releases of BotSharp up to and including 5.2.0.
SciSharp BotSharp versions up to 5.2.0 contain a critical authentication bypass vulnerability that allows unauthenticated remote attackers to forge valid bearer tokens. The flaw, tracked as CVE-2026-108860, stems from a hardcoded JSON Web Token signing key within the application's configuration files.
At a glance
- CVE
- CVE-2026-108860
- Product
- SciSharp BotSharp
- CVSS
- 9.3 Critical
- Weakness
- CWE-321
- Exploited
- No known exploitation
According to the National Vulnerability Database, the vulnerability carries a CVSS score of 9.3, which is classified as critical. Attackers can exploit this weakness by using the exposed HMAC secret to sign tokens with the fixed issuer and audience values defined in the software.
Context and Background
The vulnerability is categorized under CWE-321, which relates to generation of secret that is not sufficiently random or long. In this specific instance, the secret is not randomly generated but is instead hard-coded directly into the source code. This practice eliminates the uniqueness of the authentication mechanism across different installations.
The flaw is located in the appsettings.json file associated with the WebStarter component of the BotSharp platform. Because the key is committed to the repository or distribution package, any remote attacker can retrieve it without needing prior access to the system.
Who Is Affected
All installations of SciSharp BotSharp running version 5.2.0 or earlier are affected by this vulnerability. The issue impacts the Authorize-protected API routes within the application, which rely on the compromised JWT mechanism for user verification.
An attacker who successfully forges a bearer token can impersonate any known user within the system. This includes high-privilege accounts such as administrators, allowing for full control over protected resources and data without triggering standard authentication alerts.
No patch or fix has been confirmed yet by the vendor for this specific CVE. Users should monitor official channels for updates regarding version 5.2.1 or later releases that may address the hardcoded key issue.
What should you do?
Organizations using BotSharp should immediately verify if they are running version 5.2.0 or an earlier release. If the software is in use, administrators should isolate the affected systems from untrusted networks to prevent remote exploitation.
What to do and how to stay safe: BotSharp
- Audit your BotSharp installations to confirm the installed version is not 5.2.0 or lower.
- Review network logs for any unauthorized API requests to Authorize-protected routes.
- Restrict external access to BotSharp endpoints until a vendor update is available.
- Monitor official SciSharp communications for a confirmed patch or mitigation guidance.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108860?
The CVSS score is 9.3, which is rated as critical severity.
Which versions of BotSharp are affected?
All versions of SciSharp BotSharp up to and including 5.2.0 are affected.
Can an attacker become an administrator with this flaw?
Yes, attackers can impersonate any known user, including administrators, by forging tokens.
