{"id":"CVE-2026-53709","published":"2026-10-13T15:17:44.873","lastModified":"2026-10-16T22:17:23.737","description":"MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-321","CWE-798","CWE-1188"],"vendors":[],"products":[],"references":[{"url":"https://github.com/IBM/mcp-context-forge/commit/2af690f894b6e35f5f21190fdab1505f023a5272","tags":[]},{"url":"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.2","tags":[]},{"url":"https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-m8rv-5m6m-32ff","tags":[]}],"exploitRefs":[{"url":"https://github.com/IBM/mcp-context-forge/commit/2af690f894b6e35f5f21190fdab1505f023a5272","tags":[]},{"url":"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.2","tags":[]},{"url":"https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-m8rv-5m6m-32ff","tags":[]}],"hasPoc":true,"ai":{"summary":"The MCP Context Forge platform contains a hardcoded JWT secret key that allows unauthenticated attackers to forge administrator tokens, enabling full administrative access without needing valid user accounts or passwords. This vulnerability persists even after password changes, account deletions, or session revocations.","exploitability":"Exploitation is extremely easy with no prerequisites - attackers simply need to generate a JWT token using the known HS256 secret key and can immediately assume administrator privileges.","blast_radius":"The impact could be severe across all platform administrative functions including data modification, service disruption, and complete administrative control over the gateway platform.","remediation":"Upgrade to version 1.0.2 immediately to fix the hardcoded JWT secret key vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","jwt","admin-access"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:46:56.916Z"}}