Key points
- CVE-2026-108860 is rated Critical with a CVSS score of 9.3 by the National Vulnerability Database.
- The vulnerability affects BotSharp versions up to and including 5.2.0 developed by SciSharp.
- Attackers can impersonate any user, including administrators, without needing valid credentials.
The short version
- SciSharp BotSharp through version 5.2.0 contains a critical authentication bypass flaw.
- The bug stems from a hardcoded JWT signing key found in the WebStarter appsettings.json file.
- Unauthenticated attackers can use this exposed secret to forge valid bearer tokens for API access.
The details
SciSharp BotSharp, an open-source framework for building chatbots, contains a severe authentication bypass vulnerability tracked as CVE-2026-108860. According to the National Vulnerability Database, the flaw affects all versions of the software up to and including 5.2.0. The issue arises because the application uses a hardcoded `Jwt:Key` within its `WebStarter appsettings.json` configuration file. This key serves as the HMAC secret required to sign JSON Web Tokens (JWTs) for authentication.
Because the signing secret is committed directly into the codebase rather than being managed securely, it is accessible to anyone who can inspect the application files. An unauthenticated remote attacker can extract this hardcoded key and use it to sign their own bearer tokens. The NVD record notes that attackers can utilize the fixed `botsharp` issuer and audience values alongside the stolen secret to create valid tokens. These forged tokens allow the attacker to bypass standard login procedures entirely.
The context
The impact of this vulnerability is significant because it grants attackers the ability to impersonate any known user within the BotSharp system. According to the NVD description, this includes administrative accounts. Once an attacker has forged a token, they can access API routes that are protected by authorization checks. The vulnerability is classified under CWE-321, which covers the use of hard-coded credentials. The National Vulnerability Database has assigned the flaw a CVSS score of 9.3, rating it as Critical. This high score reflects the ease of exploitation and the severe consequences of unauthorized administrative access.
What to watch
Organizations using BotSharp should monitor their systems for signs of unauthorized administrative activity. Since the flaw allows token forgery, standard login logs may not show failed password attempts from attackers. Instead, look for successful API calls from unexpected IP addresses or user agents. Security teams should also verify if their BotSharp deployments are running version 5.2.0 or earlier. Any instance using these versions is potentially vulnerable to this specific authentication bypass method.
What to do and how to stay safe: BotSharp
- Audit your BotSharp installations to confirm if they are running version 5.2.0 or any earlier release.
- Review the `WebStarter appsettings.json` file in your deployment to check for hardcoded JWT signing keys.
- Monitor server logs for API requests containing bearer tokens that were not issued through your standard authentication flow.
- Restrict network access to the BotSharp API endpoints to trusted IP ranges until a secure configuration method is implemented.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of BotSharp are affected by CVE-2026-108860?
All versions of SciSharp BotSharp up to and including 5.2.0 are affected by this vulnerability.
How severe is this authentication bypass vulnerability?
The National Vulnerability Database rates CVE-2026-108860 as Critical with a CVSS score of 9.3.
Can an attacker become an administrator using this flaw?
Yes, attackers can forge tokens to impersonate any known user, including administrators, on protected API routes.
