Jpom Authentication Bypass Lets Attackers Gain Super-Admin Access

Jpom versions 2.10.0 through 2.11.12 contain an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access.

The flaw is triggered by injecting query conditions into the JPOM-USER-TOKEN header. A value like 'is not null' is treated by Hutool's Condition parser as an operator.

An attacker can then execute commands through Jpom's script features.