Advisory · CVE-2026-120201
Unauthenticated super-admin takeover in Jpom via token header injection
Jpom 2.10.0 through 2.11.12 lets unauthenticated attackers gain super-administrator access by injecting a condition expression into the JPOM-USER-TOKEN header, then execute commands through the script features.
- Vendor
- dromara
- Product
- Jpom
- Identifier / CWE
- CVE-2026-120201
CWE-943 - Action timing
- Immediate
Explain it like I’m five
Jpom asks callers for a secret code, but if you hand it the phrase 'is not null' instead of a code, it reads the phrase as an instruction and hands over the master key.
- 01Crafted header
An unauthenticated attacker sends a request carrying JPOM-USER-TOKEN with the value 'is not null'.
- 02Condition evaluated
The header value is passed unchecked into a Hutool query builder, which treats it as a query condition, producing a lookup for any user with a password set.
- 03Admin session granted
The query returns the first enabled user, the super administrator on a fresh installation, and the interceptor writes that user into the session.
- 04Command execution
From the administrator session, the attacker saves a server-side script and triggers it, running shell commands as the Jpom process user.
What happened
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability in its open-API token header handling. The JPOM-USER-TOKEN header is expected to carry a user’s password digest, but the interceptor passes the raw header value into a user lookup built with Hutool’s query-by-bean helper, which parses the value as a query condition. Sending the value ‘is not null’ turns the lookup into a search for any user with a password set, returning the first enabled user, which on a fresh installation is the super administrator jpomadmin. No credentials are required. The record rates it critical at CVSS 9.8.
From the resulting administrator session, an attacker can save a server-side script and trigger it, executing shell commands as the Jpom process user, and through Jpom’s node features reach managed hosts. In the official image the process runs as root.
No fixed release is stated in the NVD record or the vendor sources checked for this run, and the disclosure notes master is still affected, so this advisory claims none. The exposure itself is the urgent fact: any internet-reachable Jpom server can be taken over with a single crafted header.
What to do
- Inventory Jpom servers and nodes, including development, demo, and individually managed deployments.
- Do not expose Jpom to untrusted networks; restrict it to trusted hosts and VPN-only access while no fix exists.
- Track the vendor fix for issue 121 and upgrade to a patched release as soon as the vendor publishes one.
- Review access logs for requests carrying unusual JPOM-USER-TOKEN values, especially condition-like strings such as ‘is not null’.
- If exploitation cannot be excluded, treat the host and its managed nodes as compromised: rebuild them and rotate credentials and tokens reachable from the Jpom process.
Management note
This is an unauthenticated takeover of deployment infrastructure with no patch available yet. Network exposure is the whole attack: pull Jpom behind trusted access now rather than waiting for a version number, and treat any reachable instance as already probed.