Simple Admin Core 1.8.7 Has Critical Authentication Bypass Vulnerability

Simple Admin Core through version 1.8.7 contains a critical authentication bypass vulnerability that allows unauthenticated attackers to gain full administrative control. The flaw enables malicious actors to forge super administrator tokens using a hard-coded secret found in the application’s configuration files.

The vulnerability, identified as CVE-2026-111690, has been assigned a CVSS score of 9.3, which is classified as Critical. According to the National Vulnerability Database, the issue stems from a weakness categorized under CWE-321. This high severity rating reflects the ease with which an attacker can exploit the flaw without needing prior credentials or access to the system.

Context and Background

The core of this vulnerability lies in the presence of a hard-coded `Auth.AccessSecret` within the `api/etc/core.yaml` file. An attacker can retrieve this public secret and use it to sign a JSON Web Token (JWT). By setting the `roleId` claim to `001` in the forged token, the attacker successfully impersonates a super administrator.

This mechanism bypasses standard authentication checks entirely. The National Vulnerability Database notes that the weakness allows for the creation of valid tokens that the application accepts as legitimate. Consequently, the attacker gains immediate and unrestricted access to the administrative interface without requiring valid user credentials.

Who Is Affected

Any organization or individual running Simple Admin Core versions up to 1.8.7 is affected by this vulnerability. The flaw grants the attacker full administrative control over several critical components of the application. This includes the ability to manage users, modify roles, alter menus, and adjust API authorities.

Furthermore, the attacker can change system configuration settings and generate additional tokens. This level of

What to do and how to stay safe

• Vulnerability severity scores ignore your specific architecture and context.
• Exploitability depends on network exposure and user behavior, not just code flaws.
• Prioritization requires continuous asset inventory and threat intelligence alignment.

Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.