CVE-2026-120201 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header
CriticalCVSS 9.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.dromara.jpom/server | >= 2.10.0, <= 2.11.12 | No fix listed |
| dromara Jpom | >= 2.10.0, < 2.11.13 | 2.11.13 |
References
- GitHub Issue #121 exploit issue-tracking vendor-advisory
- github.com product technical-description
- github.com product
- VulnCheck Advisory: Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header third-party-advisory