A critical flaw in BotSharp allows attackers to forge admin tokens using a hardcoded secret, enabling full system compromise.
Key points
- CVE-2026-108860 affects BotSharp versions up to and including 5.2.0.
- The vulnerability is rated 9.3 Critical on the CVSS scale by the NVD.
- Attackers can impersonate any user, including administrators, without authentication.
SciSharp BotSharp versions up to 5.2.0 contain a critical authentication bypass vulnerability. This flaw allows remote attackers to forge tokens and gain administrative access to the application.
What happened
The National Vulnerability Database records CVE-2026-108860 as a critical issue with a CVSS score of 9.3. The vulnerability stems from CWE-321, which relates to hardcoded cryptographic keys. In BotSharp through version 5.2.0, the WebStarter application includes a hardcoded Jwt:Key in its appsettings.json file. This configuration error exposes the HMAC secret used to sign JSON Web Tokens.
An unauthenticated remote attacker can retrieve this committed secret from the application configuration. The attacker then uses the fixed botsharp issuer and audience values to sign new bearer tokens. This process allows the creation of valid authentication tokens without knowing any actual user passwords. The forged tokens are accepted by the application as legitimate credentials.
Why it matters
This vulnerability grants attackers the ability to impersonate any known user within the BotSharp system. According to the NVD record, this includes high-privilege accounts such as administrators. The attacker gains access to API routes protected by the Authorize attribute. This effectively bypasses all standard authentication controls for the application.
The impact is severe because the secret key is hardcoded and fixed. There is no unique key per installation to limit the blast radius. Any instance of BotSharp up to version 5.2.0 using the default WebStarter configuration is vulnerable. Attackers do not need to exploit complex logic flaws to gain entry.
The fix
- Upgrade BotSharp to a version newer than 5.2.0 if a patch has been released.
- If no update exists, remove the hardcoded Jwt:Key from appsettings.json.
- Replace the static secret with a unique, randomly generated key for each installation.
- Ensure the issuer and audience values are not easily guessable or fixed defaults.
What to do and how to stay safe: BotSharp
- Scan your infrastructure for any installations of BotSharp version 5.2.0 or earlier.
- Review application configuration files for hardcoded secrets or default cryptographic keys.
- Monitor server logs for unusual authentication patterns or token generation spikes.
- Once the vendor provides an update, apply it immediately to restore security controls.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108860?
The NVD rates CVE-2026-108860 as 9.3 Critical.
Which versions of BotSharp are affected?
BotSharp versions up to and including 5.2.0 are affected.
How do attackers exploit this vulnerability?
Attackers forge bearer tokens using the hardcoded Jwt:Key found in the WebStarter appsettings.json file.
