What allows anyone to pretend to be an admin in BotSharp 5.2.0?

The National Vulnerability Database published a record for CVE-2026-108860, identifying a critical authentication bypass in BotSharp through version 5.2.0. This vulnerability allows unauthenticated remote attackers to forge bearer tokens by leveraging a hardcoded secret key found in the application's configuration files, effectively bypassing standard login procedures.

According to the NVD record, the flaw stems from a hardcoded Jwt:Key within the WebStarter appsettings.json file. Attackers can use this committed HMAC secret, along with the fixed botsharp issuer and audience values, to sign valid tokens. This enables them to impersonate any known user, including administrators, on Authorize-protected API routes without needing legitimate credentials.

Context and Background

The vulnerability is classified as critical with a CVSS score of 9.3. The weakness is categorized under CWE-321, which relates to generation of error containing sensitive information, but specifically here involves the insecure handling of cryptographic keys. The hardcoded nature of the key means that anyone with access to the source code or configuration files can replicate the signing process.

This issue affects the SciSharp BotSharp platform. The vulnerability exists in the WebStarter component, which is likely used for initial setup or development. Because the key is hardcoded rather than dynamically generated or securely stored, it presents a static target for attackers who can inspect the application's configuration or source code to extract the necessary secrets.

Who is Affected

The NVD record states that BotSharp through version 5.2.0 is affected by this vulnerability. This includes any deployment of the SciSharp BotSharp platform that utilizes the WebStarter appsettings.json file with the default or hardcoded configuration. Organizations running these versions are exposed to the risk of unauthorized access to their API endpoints and user impersonation.

System administrators managing BotSharp instances should verify their current version immediately. If the deployment is at or below version 5.2.0, the system is vulnerable to this specific authentication bypass. The risk is heightened for any instance exposed to the internet or accessible by unauthenticated users, as no prior login is required to exploit the flaw.

Next steps

No official patch or fix has been confirmed yet by the vendor or in the NVD record. Security teams should monitor official channels from SciSharp for updates. In the interim, administrators can mitigate risk by changing the hardcoded Jwt:Key in the appsettings.json file to a strong, randomly generated secret. Additionally, restricting network access to the BotSharp API endpoints can reduce the attack surface for unauthenticated remote attackers.

What to do and how to stay safe: BotSharp

• Audit your BotSharp version and check if it is at or below 5.2.0 to determine exposure.
• Review the WebStarter appsettings.json file for hardcoded cryptographic keys and replace them with secure, unique values.
• Implement network-level restrictions to limit access to BotSharp API endpoints to trusted IP ranges only.
• Monitor server logs for unusual authentication attempts or token usage patterns that may indicate exploitation.

Step-by-step guide: Emergency Patching Checklist for Critical System Fixes

General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108860?

The CVSS score for CVE-2026-108860 is 9.3, which is rated as critical.

Which versions of BotSharp are affected by this vulnerability?

BotSharp through version 5.2.0 is affected by this authentication bypass vulnerability.

How do attackers exploit this vulnerability?

Attackers forge bearer tokens using the hardcoded Jwt:Key in the WebStarter appsettings.json file to impersonate users.