PT-2026-3519 · Mineadmin · Mineadmin

Sourbyte + 1 · Published 2026-01-20 · Updated 2026-03-26 · CVE-2026-1195

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MineAdmin versions 1.x and 2.x

Description A weakness exists due to insufficient verification of data authenticity within the JWT Token Handler component. This issue affects the refresh function of the /system/refresh file. The attack can be initiated remotely and is considered to have high complexity, though exploitability is difficult. The exploit has been publicly released. The vendor was notified but did not respond.

Recommendations Versions prior to 1.x and 2.x should be updated. As a temporary workaround, consider disabling the refresh function until a patch is available. Restrict access to the /system/refresh file to minimize the risk of exploitation.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-1195

GHSA-43RR-X62X-Q96W

Affected Products

Mineadmin

References · 10

• 🔥 https://github.com/SourByte05/MineAdmin-Vulnerability/issues/4 · Exploit
• https://osv.dev/vulnerability/GHSA-43rr-x62x-q96w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1195 · Security Note
• https://github.com/mineadmin/mineadmin · Note
• https://vuldb.com/?id.341780 · Note
• https://twitter.com/PentesterLab/status/2037065800838971471 · Twitter Post
• https://twitter.com/CVEnew/status/2013420071306068470 · Twitter Post
• https://vuldb.com/?ctiid.341780 · Note
• https://vuldb.com/?submit.734272 · Note