NVD security advisoryCritical
Critical advisory for Jpom 2.10.0
CVE-2026-120201 · Reported 31 Oct 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
Jpom 2.10.0Affected product
Advisory overview
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Related references
- https://github.com/dromara/Jpom
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/common/interceptor/LoginInterceptor.java#L146
- https://github.com/dromara/Jpom/issues/121
- https://www.vulncheck.com/advisories/jpom-2.10.0-through-2.11.12-authentication-bypass-via-jpom-user-token-header