CVE-2026-119597 OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
CriticalCVSS 9.3
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| AIDotNet OpenDeepWiki | <= 2.0.6 | No fix listed |
References
- github.com patch
- github.com issue-tracking
- github.com technical-description
- github.com technical-description
- hackmd.io exploit third-party-advisory
- github.com product
- VulnCheck Advisory: OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery third-party-advisory