CVE-2026-52539

Deferred Deferred - Pending Action

Hardcoded JWT Secret in Outstatic CMS

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: MITRE

Description

Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT session tokens with arbitrary user data and full administrative permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-52539

Affected Vendors & Products

Vendor	Product	Version / Range
outstatic	cms	2.1.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

Outstatic CMS versions 2.1.9 and below use a hardcoded JWT signing secret. If the OST_TOKEN_SECRET environment variable is missing, the app defaults to a publicly known secret from its source code. Attackers can forge JWT tokens to gain unauthorized access with admin privileges.

Detection Guidance

Check if the OST_TOKEN_SECRET environment variable is set to the default hardcoded value by inspecting the application's environment configuration or source code. Look for the presence of JWT tokens with signatures that match the default secret.

Impact Analysis

An attacker could impersonate any user, including administrators, access sensitive data, modify content, or take full control of the CMS. This could lead to data breaches, defacement, or unauthorized system changes.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by enabling unauthorized access to personal or health data. It compromises data integrity, confidentiality, and access controls required by these regulations.

Mitigation Strategies

Set a strong, unique OST_TOKEN_SECRET environment variable to override the default hardcoded value. Update Outstatic CMS to a version that does not use a hardcoded JWT secret. Rotate all existing JWT tokens to invalidate any forged sessions.

Hi! I’m here to help you understand CVE-2026-52539. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70