SZB-00651b6569
CVE-2026-119597 discloses hard-coded JWT signing key in OpenDeepWiki
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- OpenDeepWiki
- Product
- OpenDeepWiki
- First seen
Summary
A CVE entry reported via TheHackerWire, with a CVSS score of 9.8, says OpenDeepWiki through 2.0.6 uses a publicly known JWT signing key in appsettings.json. According to the item, this lets unauthenticated attackers forge administrator tokens.
If you use OpenDeepWiki
Upgrade OpenDeepWiki beyond version 2.0.6 once a fixed release is available
Change the Jwt:SecretKey value and do not rely on the default key in appsettings.json
Restrict network exposure of OpenDeepWiki instances
Review administrator activity for unexpected actions
What the sources say 1
· Mastodon: “OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json.” Source