SECURITYCRITICALCVE-2026-120201

CVE-2026-120201: Jpom Authentication Bypass Grants Super-Admin Access

Jpom 2.10.0 through 2.11.12 lets unauthenticated attackers become super-admin by injecting query conditions into the JPOM-USER-TOKEN header (CVSS 9.8).

Dylan H.

Security Team

November 1, 2026
2 min read
CVE-2026-120201: Jpom Authentication Bypass Grants Super-Admin Access

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Jpom 2.10.0 through 2.11.12

Executive Summary

CVE-2026-120201 is a critical authentication bypass (CVSS 9.8) in Jpom versions 2.10.0 through 2.11.12, an open-source Java project and server operations platform. Unauthenticated attackers can gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN HTTP header.

Vulnerability Details

FieldDetails
CVECVE-2026-120201
CVSS Score9.8 (Critical)
Published2026-10-31
TypeAuthentication bypass via condition injection
Affected Versions2.10.0 through 2.11.12
AuthenticationNone
Attack VectorNetwork
ImpactSuper-administrator access

Technical Analysis

Jpom looks up the logged-in user from the value of the JPOM-USER-TOKEN header. Per the CVE description, the value is passed into a Hutool condition parser rather than being treated as an opaque string. An attacker who sends a value such as is not null causes the parser to build a condition that matches an existing user record, so the lookup succeeds without a valid token.

GET /api/... HTTP/1.1
JPOM-USER-TOKEN: is not null

The result is a session mapped to a privileged account, with no credentials involved. Because Jpom is used to manage servers, projects, and deployments, super-admin access is typically a stepping stone to command execution on managed nodes.

Affected Environments

Any Jpom server in the 2.10.0 – 2.11.12 range reachable by an attacker. Management consoles exposed to the internet or to broad internal networks are at greatest risk.

Remediation

  1. Upgrade to a Jpom release newer than 2.11.12 once the project publishes a fix; check the project's release notes and security advisories.
  2. Restrict access — place the Jpom console behind a VPN, allow-list, or authenticating reverse proxy.
  3. Filter the header — as a stopgap, have the proxy reject JPOM-USER-TOKEN values that do not match the expected token format.
  4. Review — audit Jpom user accounts, API tokens, and recent script or deployment executions for unauthorized changes.

Detection

  • Search web or proxy logs for JPOM-USER-TOKEN values containing spaces or SQL-like keywords (is, not, null, like, or).
  • Alert on admin-level actions from IP addresses not previously associated with administrators.

References