CVE-2022-35540: Dotnetcore Agileconfig

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.

Affected products

• Dotnetcore Agileconfig: before 1.6.8 (fixed in 1.6.8)

Published 2022-08-18. Last modified 2026-06-17.