OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
Affects OpenDeepWiki through 2.0.6 deployed with the publicly known default JWT signing key in appsettings.json. No fixed version is listed; setting a strong JWT_SECRET_KEY is the workaround.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenDeepWiki, an AI-powered code documentation application, is affected by this vulnerability. An unauthenticated attacker who knows the hard-coded JWT signing key shipped in its configuration file could forge administrator tokens and take full control of user accounts, roles, repositories, settings, and API keys.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- AIDotNet OpenDeepWiki
through 2.0.6
References 7
GitHub · AIDotNet/OpenDeepWiki
Questions about CVE-2026-119597
What does this mean?
The app's default JWT signing key is committed in appsettings.json and is publicly known. Anyone who knows it can forge an Admin token and gain administrator access.Source: github.com
Am I affected, and how do I check?
OpenDeepWiki versions through 2.0.6 are affected when deployed with the publicly known default signing key. To check a deployment, look at whether JWT_SECRET_KEY is set to a strong random value or the default from appsettings.json.Source: github.com
What should I do about it?
Set a strong random JWT_SECRET_KEY and redeploy, which invalidates existing tokens. The advisory cites commit 1bf0f4b as the fix, but no fixed release version is listed.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data