lee1981 (@lee1981b) on X

What it is

CVE-2026-108860 is an authentication bypass in SciSharp BotSharp (WebStarter / BotSharp.OpenAPI bearer authentication), affecting versions through 5.2.0 inclusive. The CNA is VulnCheck and the finder is hieuPenguinnn. The weakness is CWE-321, a hard-coded cryptographic key. The scores are CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and v4.0 9.3. NVD carries these as VulnCheck-attributed scores, not independent NIST scoring.

How it works

The shipped project config commits a usable HMAC signing secret (Jwt:Key, with Jwt:Issuer and Jwt:Audience; the published issuer/audience label is botsharp). WebStarter enables validation, and the bearer handler builds its signing key from that configured string. Verification works as designed, but signing authority is no longer exclusive. Anyone with the public default can mint a token the verifier accepts, and issuer or expiry checks cannot compensate. The CNA describes impersonation of known users, including administrators. Source review found claim-derived identity plus backing-user and authorisation checks. The reviewed /user/me GET can auto-create users when enabled.

Preconditions / Affected

• The build is 5.2.0 or earlier, and a reachable deployment still trusts the published default as its effective key.
• A file match alone is only a lead. ASP.NET Core can override JSON via environment-specific settings, environment variables (Jwt__Key), command-line input and other providers, so check the effective runtime state.
• Check every serving copy: replicas, rollout overlap, standby or recovery nodes and exposed dev instances.
• Installed files and tags can differ from serving code, so confirm the serving build.

What to do

1. Scope. Confirm the serving build, the effective signing key, validation setup and real API reachability (proxy routes and direct listeners) on every node.
2. Preserve evidence before expiry: ingress/proxy, app auth, legitimate token/SSO issuance, deployment and secret-change logs. Keep tokens and secrets restricted.
3. Rotate. The application or identity owner replaces the shared HMAC secret and retires old trust on every issuer and verifier, including cached options and fallback keys. Do not disable signature validation. Changing only issuer labels, user passwords or Swagger visibility does not help.
4. Verify rollout and normal service on each node, and record when old trust was finally retired.
5. Hunt for protected activity that lacks a legitimate issuance or authority explanation. Join accepted requests to backing identity, object changes and role changes by node, request/trace ID and bounded UTC time. Start the window at the earliest exposed-trust time, not at the publication date.
6. Assess separately cookie/SSO sessions and connected credentials, since JWT key rotation is not universal revocation.

The researcher proposes removing usable secrets from source, requiring a strong private secret, and failing startup if the key is absent or known public. This is not a merged vendor patch.

Caveats

• No verified fixed release exists. The latest release (r5.2-image-composition, 17 Oct 2025) and the examined master commit (29 Sep 2026) both still declare 5.2.0 and retain the default. Don't assume a 5.2.1 or clear a different version number. Get maintainer guidance.
• The linked research is static-only. There is no runtime reproduction, no verified field exploitation, and downstream rights and actions are untested. Universal RCE or root is not established.
• KEV had no match, but the catalogue (2026.10.08) predates publication on 11 Oct 2026. EPSS returned empty data, which means unavailable, not zero. There is no CISA ADP/SSVC assessment.
• No malicious IOC set exists. Jwt:Key, the botsharp issuer and ordinary bearer headers are normal context.
• An accepted response, or the absence of a fresh login, proves neither compromise nor its absence. Don't paste captured tokens into public decoders or replay suspicious requests.
• The post's offline fingerprint-check and Docker-inspect aids were tested only on 40 synthetic scenarios, not against live BotSharp.