CVE-2026-108753
Received Received - Intake

Hard-Coded Admin Credentials in Agnaistic

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108753
EUVD
EUVD-2026-96918

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
agnaistic agnai 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves hard-coded credentials in the Agnaistic agnai application up to version 1.0.555. The self-host.docker-compose.yml file contains fixed admin credentials and a public JWT secret. Unauthenticated attackers can exploit this to log in as an admin or forge admin tokens, gaining full administrative access to the system.

Detection Guidance

Check the self-host.docker-compose.yml file for hard-coded admin credentials and JWT secrets. Look for environment variables like ADMIN_PASSWORD and JWT_SECRET in the Agnai service configuration. If these values are set to defaults like 'password' or 'self-hosting', the system is vulnerable.

Impact Analysis

Unauthenticated attackers can impersonate users, reset passwords, and modify server configurations. They can also forge admin tokens to gain persistent administrative access, even if the admin password is changed later. This allows full control over the application and user data.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires strong authentication and protection of user data, while HIPAA mandates strict access controls for sensitive health information. The hard-coded credentials and lack of proper authentication undermine these requirements.

Mitigation Strategies

Remove hard-coded credentials from the Docker Compose file. Replace default admin password and JWT secret with strong, unique values. Regenerate all JWT tokens after changing the secret. Restart the Agnai service to apply changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108753. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart