Tools AI Risk Radar ai-incident-0215
Incident record
BotSharp’s default signing key permits forged login tokens
- Severity
- Critical
- Status
- Research
- Type
- Infra Vuln
- Target
- BotSharp through 5.2.0
- Actor
- researcher
- CVE
- CVE-2026-108860
What happened
Deployments retaining BotSharp’s public default JWT signing key can accept forged login tokens, including tokens for a known administrator identity.
The CNA published the record on 11 October. Its CVSS 3.1 score is 9.1. The reported precondition is use of the default key. Replacing it is a configuration mitigation; a fixed release remains unconfirmed as of 13 October.
Sources
- Original advisory or disclosurehackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/scisharp-botsharp-public-j…
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-108860
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026