Ape-Volo Admin JWT Authentication Bypass Vulnerability

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability.

Unauthenticated attackers can forge administrator tokens using a hardcoded JWT signing key in appsettings.json. They can sign these tokens offline by setting the jti claim to the seeded administrator id.

• Full API control over users
• Full API control over roles
• Full API control over permissions
• Full API control over data