Summary
generated automatically from NVD dataOpenDeepWiki through version 2.0.6 ships with a hard-coded JWT signing key (Jwt:SecretKey in appsettings.json, classified as CWE-321), and because that key is publicly known, an unauthenticated attacker can sign their own HS256 bearer tokens carrying an Admin role claim. Such forged tokens grant access to the /api/admin endpoints, allowing control over users, roles, repositories, settings, and API keys. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8.
NVD description
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
EPSS · FIRST.org
0.37%probability of exploitation in the next 30 days
Higher than 31% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-31, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 30 oct. 2026
- Updated
- 30 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (7)
Similar CVEs
Other vulnerabilities of type CWE-321
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.