Executive brief
SiteServer SSCMS is a content management system used to manage websites and web content. A flaw in the Agent Installation component allows an attacker to manipulate security parameters and bypass authentication controls, potentially enabling unauthorized access to administrative functions and full system takeover after installation.
Technical details
The vulnerability is an improper access control issue in the Agent Installation Workflow component of SiteServer SSCMS 7.4.0. The AgentController API endpoints lack class-level authorization protections and rely solely on a SecurityKey string for authentication. The same SecurityKey is reused as the HMAC-SHA256 signing key for all JWT tokens. An attacker can obtain the SecurityKey during the installation phase via the InstallController.Prepare endpoint or by reading the sscms.json configuration file, then forge administrator JWT tokens to achieve complete system compromise. Remote exploitation is possible, though the attack is considered to have high complexity.
Affected products
- SiteServer SSCMS 7.4.0
Timeline
- 2026-07-13: disclosed: Issue reported on GitHub
- 2026-08-30: other: CVE published