CVE-2026-119597 Details
Description
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
A vulnerability exists in OpenDeepWiki versions through 2.0.6, where a hard-coded JSON Web Token (JWT) signing key allows unauthenticated attackers to forge administrator tokens. The vulnerability arises because the default key is publicly known and is used as a fallback in the application settings. Attackers can create HS256 bearer tokens with an Admin role claim and access the /api/admin endpoints, where they can manage users, roles, repositories, settings, and API keys.
Users are advised to update to version 2.0.6 or later, where this vulnerability has been fixed. After updating, the JWT secret key should be set to a strong, random value, and the admin password should be changed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery | CISA-ADP | ExploitRemedyTechnical Analysis |
| https://github.com/AIDotNet/OpenDeepWiki | [email protected] | Source CodeVendor |
| https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27 | [email protected] | Source CodeVendor |
| https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92 | [email protected] | Source CodeVendor |
| https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544 | [email protected] | Source CodeVendor |
| https://github.com/AIDotNet/OpenDeepWiki/issues/403 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/opendeepwiki-through-2.0.6-hard-coded-jwt-signing-key-admin-token-forgery | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AIDotNet OpenDeepWiki | <= 2.0.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |