BotSharp hardcoded JWT key leads to authentication bypass
Start here
BotSharp 5.2.0 and earlier versions have an authentication bypass vulnerability. According to VulnCheck, an unauthenticated remote attacker can exploit the hardcoded Jwt:Key in the WebStarter appsettings.json to forge a bearer token, impersonating any known user, including an administrator, to access API routes protected by Authorize. An attacker can sign a token using the committed HMAC key and the fixed botsharp issuer and audience.
Generated by AI from reports · Updated 5 hr ago
Progress timeline
- VulnCheckBotSharp agent framework has hardcoded JWT key, allowing admin token forgery
BotSharp 5.2.0 and earlier versions have an authentication bypass vulnerability. An unauthenticated remote attacker can exploit the hardcoded Jwt:Key in the WebStarter appsettings.json to forge a bearer token, impersonate any known user including an administrator, and access API routes protected by Authorize. The attacker can sign the token using the committed HMAC secret along with the fixed botsharp issuer and audience.
Related discussion
Attention trend
New sources per day
- Oct 12New1 sources (1 outlets,0 accounts)