Jpom's User Token Header Reached a Query Parser With Super-Administrator Consequences
Jpom's User Token Header Reached a Query Parser With Super-Administrator Consequences A token lookup should answer one question: does this value identify a valid user? CVE-2026-120201 describes a Jpom authentication pa
Jpom's User Token Header Reached a Query Parser With Super-Administrator Consequences
A token lookup should answer one question: does this value identify a valid user? CVE-2026-120201 describes a Jpom authentication path where an attacker-controlled token header reached a query-condition parser with more expressive results.
The affected releases are Jpom 2.10.0 through 2.11.12. The GitHub Advisory Database rates the issue Critical with a CVSS score of 9.3.
How the bypass works
The advisory says an unauthenticated attacker can inject query conditions through the JPOM-USER-TOKEN header. A value such as is not null is interpreted by Hutool's Condition parser as an operator rather than an opaque token.
The lookup can therefore match a user record without possession of that user's real token. The attacker obtains super-administrator access. Jpom's script features then give the attacker a path from authenticated application control to command execution on managed systems.
The vulnerability combines two failures. The authentication input is not constrained to the token format the application expects, and the token lookup is built in a way that lets a parser interpret input as query logic. The second failure turns a malformed token into a broad match.
Why the control plane matters
Jpom manages builds, deployments, server operations and scripts. Those features are designed to act on other systems. An administrator-level bypass can therefore affect more than the Jpom server.
Review managed node credentials, SSH keys, deployment tokens and script history. Search for new users, changed permissions, unexpected build jobs and script executions. If the attacker reached a managed host, evidence may exist in shell history, process logs and deployment artifacts as well as in Jpom's own audit records.
The advisory does not describe a proof of exploitation in the wild. It does show a direct route from a network request to administrative action when the vulnerable version is reachable.
Exposure review
Identify Jpom servers on the internet and inside management networks. Check whether the login endpoint can be reached without a VPN or an application proxy. Review the value of the JPOM-USER-TOKEN header in reverse-proxy logs where header logging is enabled and appropriate.
The application may be protected by a gateway that authenticates users before forwarding traffic. That reduces reachability but does not repair the application parser. Keep the gateway restriction while a fixed build is validated.
Remediation
Apply a Jpom release that contains the vendor fix. The advisory records the affected range but lists no patched version, so administrators should verify the fix with the upstream project rather than infer a version from a project tag.
Until patched, remove internet exposure, restrict access to trusted administration networks and disable or tightly limit script execution. Rotate credentials for Jpom and every managed node it can reach. Review audit logs for authentication successes that do not match a real token lifecycle.
Verification
After upgrading, test token validation with malformed values in a non-production environment. Confirm that an invalid conditional expression cannot match a user and that failed lookups produce a normal authentication rejection. Test the actual deployed package, not only the source branch.
The fix should also remove the trust placed in parser semantics. A token lookup should compare a normalized opaque token with a stored hash or identifier. Operators can ask the vendor whether the patched code does that, but they should still verify the deployed behavior.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes โ full credit and traffic to the original publisher.