Jpom, a self-hosted DevOps and server-management platform, has a critical authentication-bypass vulnerability that can let unauthenticated attackers gain super-administrator access and execute commands on affected systems. Tracked as CVE-2026-120201, the flaw affects Jpom versions 2.10.0 through 2.11.12.
The public CVE record assigns the vulnerability a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3. The disclosure was filed in an open issue on Jpom’s GitHub repository by security researcher LioTree, who reported reproducing the issue on version 2.11.12.
The flaw lies in how Jpom handles its JPOM-USER-TOKEN authentication header. According to the disclosure, the application passes the supplied value into a query-condition parser without first validating that it is a legitimate token digest. An attacker can therefore make the authentication check match an enabled account and obtain an administrator session without providing valid credentials.
That session can be used to create and trigger server-side scripts, allowing command execution with the privileges of the Jpom process. The researcher’s reproduction says the official container runs the process as root, which could make a successful takeover especially serious for deployments using the affected image.
The report also says the project’s master branch was still affected at the time of disclosure. The public issue remains open, and the CVE record does not identify a fixed release. The disclosure includes a reproducible proof of concept, but the sources reviewed do not confirm exploitation in the wild.
The Jpom flaw adds to recent disclosures involving infrastructure and remote-management software, including a critical EDK II network-boot vulnerability and Tailscale SSH and Serve security flaws that could expose privileged access under specific conditions.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
