{"id":"CVE-2026-119597","published":"2026-10-30T14:16:47.770","lastModified":"2026-10-30T19:23:25.493","description":"OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/AIDotNet/OpenDeepWiki","tags":[]},{"url":"https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92","tags":[]},{"url":"https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27","tags":[]},{"url":"https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544","tags":[]},{"url":"https://github.com/AIDotNet/OpenDeepWiki/issues/403","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery","tags":[]},{"url":"https://www.vulncheck.com/advisories/opendeepwiki-through-2.0.6-hard-coded-jwt-signing-key-admin-token-forgery","tags":[]}],"exploitRefs":[{"url":"https://github.com/AIDotNet/OpenDeepWiki","tags":[]},{"url":"https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92","tags":[]},{"url":"https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27","tags":[]},{"url":"https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544","tags":[]},{"url":"https://github.com/AIDotNet/OpenDeepWiki/issues/403","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenDeepWiki through 2.0.6 uses a hard-coded JWT signing key in appsettings.json, allowing unauthenticated attackers to forge valid HS256 bearer tokens with admin privileges and gain full control of the application.","exploitability":"Trivial to exploit; requires only knowledge of the public Jwt:SecretKey value and ability to craft a JWT with an Admin role claim.","blast_radius":"Successful exploitation grants unauthenticated remote attackers full administrative control over users, roles, repositories, settings, and API keys.","remediation":"Upgrade to OpenDeepWiki version 2.0.7 or later, which removes the hard-coded secret and enforces dynamic key generation.","detection":"Look for JWT tokens signed with a known public secret (e.g., matching the documented Jwt:SecretKey value) in Authorization headers targeting /api/admin endpoints; such tokens are invalid per RFC 7519 when signed with a publicly exposed key.","tags":["jwt-forgery","auth-bypass","hardcoded-secret","admin-access","web"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:46:23.478Z"}}