Key points
- CVE-2026-108860 carries a CVSS score of 9.3, rated Critical by the National Vulnerability Database.
- The vulnerability affects BotSharp versions up to and including 5.2.0 from vendor SciSharp.
- Attackers exploit a hardcoded key in appsettings.json to impersonate any user, including administrators.
SciSharp BotSharp contains a critical authentication bypass flaw that enables unauthenticated remote attackers to forge bearer tokens. The vulnerability allows adversaries to impersonate any known user, including administrators, on API routes protected by Authorize attributes.
What happened
The issue stems from a hardcoded secret used for signing JSON Web Tokens (JWTs) within the BotSharp application. According to the National Vulnerability Database record for CVE-2026-108860, the vulnerability exists in BotSharp through version 5.2.0. Attackers can access the `Jwt:Key` value directly from the `WebStarter appsettings.json` file, which is committed to the application's configuration.
This exposed HMAC secret allows attackers to sign their own tokens using the fixed `botsharp` issuer and audience parameters. The National Vulnerability Database describes the weakness as CWE-321, indicating a hardcoded cryptographic key. By constructing a valid token with this known secret, an attacker can generate a bearer token that the application accepts as authentic. This bypasses the standard authentication mechanisms entirely, as the application trusts the token signature without verifying the user's actual login credentials.
Why it matters
The security implications are severe because the flaw grants full administrative access to unauthenticated attackers. The National Vulnerability Database rates CVE-2026-108860 as Critical with a CVSS score of 9.3, reflecting the high impact of unauthorized access. Attackers do not need to exploit complex injection flaws or guess passwords; they only need to obtain the configuration file containing the hardcoded key.
Once an attacker has forged a token, they can impersonate any known user within the system. This includes accounts with elevated privileges, allowing complete control over Authorize-protected API routes. The vulnerability affects all installations of SciSharp BotSharp up to version 5.2.0 that use the default or committed configuration settings. Security operations teams must treat this as an immediate risk, as the attack vector requires no prior authentication or interaction with the target system other than reading the public configuration.
What happens next
- Verify if your environment runs BotSharp version 5.2.0 or any earlier release from SciSharp.
- Audit the `WebStarter appsettings.json` file to confirm if the `Jwt:Key` is hardcoded or exposed in public repositories.
- Rotate any cryptographic secrets or keys that may have been committed to configuration files before the vulnerability was discovered.
- Monitor API logs for unusual authentication patterns, such as tokens generated from unexpected sources or with mismatched user contexts.
What to do and how to stay safe: BotSharp
- Review your source code repositories to ensure cryptographic keys are never committed to configuration files like `appsettings.json`.
- Implement a secret management solution to inject sensitive values at runtime rather than storing them in static files.
- Audit API endpoints to ensure that authorization checks are robust and do not rely solely on token signatures if the signing key is potentially exposed.
- Monitor for any unauthorized administrative actions in your logs, particularly those originating from IP addresses or user agents that do not match normal operational patterns.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritise Fixes That Matter
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of BotSharp are affected by this vulnerability?
The National Vulnerability Database states that BotSharp through version 5.2.0 is affected by CVE-2026-108860.
How do attackers exploit this flaw?
Attackers use the hardcoded `Jwt:Key` found in the `WebStarter appsettings.json` file to sign forged bearer tokens, allowing them to impersonate users.
What is the severity rating of CVE-2026-108860?
The National Vulnerability Database assigns a CVSS score of 9.3, classifying the vulnerability as Critical.
