CVE-2026-52539 Details
Description
Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT session tokens with arbitrary user data and full administrative permissions.
A vulnerability exists in Outstatic CMS versions through 2.1.9, where a hardcoded JWT signing secret is exposed. If the OST_TOKEN_SECRET environment variable is not configured, the application defaults to a publicly visible secret, allowing unauthenticated remote attackers to forge JWT session tokens. These tokens can include arbitrary user data and grant full administrative permissions.
Users can set the OST_TOKEN_SECRET environment variable to a secure, custom value to override the default hardcoded secret. Instructions for deploying Outstatic CMS can be found in the official documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/avitorio/outstatic | [email protected] | Vendor |
| https://github.com/avitorio/outstatic/blob/canary/packages/outstatic/src/utils/constants.ts | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Avitorio Outstatic | <= 2.1.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |