SZB-e264ba5062
OpenDeepWiki hard-coded JWT signing key allows forged admin tokens (EUVD-2026-113934)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- AIDotNet
- Product
- OpenDeepWiki
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a hard-coded JWT signing key in OpenDeepWiki through 2.0.6, scored 9.3/10 (CVSS v3.1). According to the entry, unauthenticated attackers can forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json.
If you use AIDotNet
Change the Jwt:SecretKey to a unique, random secret immediately
Upgrade OpenDeepWiki beyond 2.0.6 once a fixed version is available
Review admin accounts and activity for unexpected access
What the sources say 1
· Mastodon: “OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json.” Source