CVE-2026-119597
Received Received - Intake

Hard-Coded JWT Key in OpenDeepWiki

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119597
EUVD
EUVD-2026-113934

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AIDotNet OpenDeepWiki 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenDeepWiki through version 2.0.6 has a hard-coded JWT signing key vulnerability. This means the software uses a fixed, publicly known secret key (Jwt:SecretKey) for signing authentication tokens. Attackers can exploit this to forge administrator tokens without needing valid credentials.

Detection Guidance

Check for hard-coded JWT signing keys in appsettings.json files, particularly the Jwt:SecretKey value. Search for files containing 'Jwt:SecretKey' or 'HS256' in OpenDeepWiki installations. Verify if unauthenticated access to /api/admin endpoints is possible.

Impact Analysis

Unauthenticated attackers can gain full administrative access to the system. This includes the ability to control users, roles, repositories, settings, and API keys. They can access restricted /api/admin endpoints and perform unauthorized actions.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized administrative access, which could lead to data breaches or unauthorized modifications. Both GDPR and HIPAA require strict access controls and protection of sensitive data.

Mitigation Strategies

Immediately rotate the JWT signing key in appsettings.json to a strong, randomly generated value. Restrict access to /api/admin endpoints to authenticated users only. Update OpenDeepWiki to the latest version if a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119597. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart