CVE-2026-108860 SciSharp CVE debrief

Who should care

Defenders of BotSharp deployments, particularly those using version 5.2.0 or earlier, should assess exposure and prioritize remediation. This includes operators, administrators, and security teams responsible for maintaining and securing BotSharp installations. They should review and update BotSharp to a version beyond 5.2.0 if available, implement additional authentication mechanisms, and monitor API routes for suspicious activity.

Why it matters

CVE-2026-108860 is a critical authentication bypass vulnerability in BotSharp through 5.2.0, allowing unauthenticated remote attackers to forge bearer tokens and impersonate users on protected API routes. Defenders of BotSharp deployments should assess exposure and prioritize remediation.

• Unauthenticated remote attackers can impersonate any known user, including administrators, on Authorize-protected API routes.
• Defenders must verify BotSharp version and configuration to determine exposure.
• Remediation priority is high due to the critical CVSS score of 9.3.

Technical summary

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. This enables impersonation of any known user, including administrators, on Authorize-protected API routes. The vulnerability is due to the hard-coded Jwt:Key, which allows attackers to sign tokens with the committed HMAC secret and fixed botsharp issuer and audience. Defenders must verify BotSharp version and configuration to determine exposure and prioritize remediation.

Defensive priority

High

Recommended defensive actions

• Review and update BotSharp to a version beyond 5.2.0 if available
• Implement additional authentication mechanisms for API routes
• Monitor API routes for suspicious activity
• Restrict access to sensitive API routes
• Verify BotSharp version and configuration to determine exposure
• Conduct thorough vulnerability assessment and penetration testing to identify potential attack vectors
• Enhance incident response plans to address potential authentication bypass incidents

Evidence notes

The CVE record and source item provide details on the authentication bypass vulnerability in BotSharp through 5.2.0, which allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.