CVE-2026-120201: Critical Authentication Bypass in Jpom 2.10.0-2.11.12

CVE-2026-120201 is a critical authentication vulnerability affecting Jpom versions 2.10.0 through 2.11.12. The flaw allows an unauthenticated attacker to completely bypass authentication controls by sending a crafted value in the JPOM-USER-TOKEN header, such as 'is not null'. The Hutool Condition parser incorrectly handles this value as a logical operator, granting immediate access with super-administrator privileges to Jpom, a deployment management tool.

The vulnerability carries a CVSS score of 9.8, classified as critical. Impact is immediate: once super-administrator access is obtained, an attacker can execute arbitrary commands through Jpom's scripting functions, achieving full system control (RCE). The vulnerability was publicly disclosed in the NVD on October 31, 2026, generating discussion signals in our public resource monitoring over the past 24 hours. No active exploitation in the wild has been confirmed, but the technical simplicity of the injection and the severity make this risk a priority.

System administrators and infrastructure teams must act urgently: 1) identify all Jpom installations and their versions; 2) apply updates to versions beyond 2.11.12 as soon as available from the Dromara project; 3) where immediate update is not feasible, implement network-level access controls to trusted internal networks only; 4) monitor logs for suspicious authentication bypass patterns or unauthorized command execution.

Public discussions on social platforms (3 posts within 24 hours with 6 cumulative interactions as of October 31) indicate the vulnerability is attracting attention. While these channels often contain unverified information, they align with technical details in the official NVD documentation: JPOM-USER-TOKEN header injection, affected versions 2.10.0-2.11.12, resulting in RCE. Organizations running Jpom in critical or customer-facing environments should treat this as an immediate escalation situation.