BotSharp Authentication Bypass via Hardcoded JWT Key Exposes Admin Access
A critical flaw in BotSharp 5.2.0 allows attackers to forge tokens using a hardcoded secret, granting full administrative control without credentials.
Key points
- CVE-2026-108860 is rated Critical with a CVSS score of 9.3 by the National Vulnerability Database.
- The vulnerability stems from a hardcoded Jwt:Key in the WebStarter appsettings.json configuration file.
- Attackers can impersonate any user, including administrators, on protected API routes without authentication.
BotSharp 5.2.0 contains a critical authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens. The National Vulnerability Database (NVD) assigned CVE-2026-108860 a CVSS score of 9.3, classifying the issue as Critical. This flaw enables attackers to bypass security controls and gain unauthorized access to administrative functions within the application.
Root cause
The vulnerability exists because the BotSharp WebStarter application includes a hardcoded Jwt:Key in its appsettings.json file. According to the NVD record, this configuration weakness falls under CWE-321. The committed HMAC secret allows anyone with access to the source code or configuration files to sign valid tokens. This static key is used alongside a fixed botsharp issuer and audience value.
Attack path
Attackers exploit this flaw by signing tokens using the exposed HMAC secret found in the configuration. They can then use these forged bearer tokens to impersonate any known user within the system. The NVD description notes that this includes high-privilege accounts such as administrators. These tokens are accepted on Authorize-protected API routes, allowing full control over protected endpoints without providing legitimate credentials.
Affected versions
The vulnerability affects SciSharp BotSharp versions up to and including 5.2.0. The NVD record explicitly lists "BotSharp through 5.2.0" as affected. Organizations running any version prior to a potential future patch remain exposed to this authentication bypass. No specific version has been confirmed in the source material as containing a fix for CVE-2026-108860.
Mitigation
- Remove the hardcoded Jwt:Key from the appsettings.json file immediately if possible.
- Replace the static secret with a dynamically generated, secure key stored in environment variables.
- Rotate any existing JWT secrets that may have been exposed in public repositories or logs.
- Monitor API logs for unauthorized access attempts or unexpected administrative actions.
What to do and how to stay safe: BotSharp
- Audit your BotSharp installations to confirm if you are running version 5.2.0 or earlier.
- Review your WebStarter appsettings.json files for any hardcoded secrets or keys.
- Monitor network traffic for unusual token generation or unauthorized API calls.
- Contact the vendor for guidance on securing authentication mechanisms until an official update is released.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108860?
The National Vulnerability Database rates CVE-2026-108860 as Critical with a CVSS score of 9.3.
Which versions of BotSharp are affected by this vulnerability?
BotSharp versions up to and including 5.2.0 are affected by this authentication bypass flaw.
How do attackers exploit this hardcoded key?
Attackers use the hardcoded Jwt:Key from appsettings.json to sign bearer tokens and impersonate users.
