CVE-2026-111636
Received Received - Intake

Authentication Bypass in OpenBMB StaffDeck via Hard-Coded Secret

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111636
EUVD
EUVD-2026-103058

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpenBMB StaffDeck 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenBMB StaffDeck through version 0.5.6 has a critical authentication bypass vulnerability due to a hard-coded session secret. Unauthenticated attackers can forge administrator session tokens by signing an HMAC-SHA256 token for the 'admin' user in the 'tenant_demo' tenant. This grants full tenant administration privileges, including access to stored model and channel credentials.

Detection Guidance

Check StaffDeck configuration files for hard-coded secrets in config.py or auth.py. Search for 'change-me-in-development' or 'app_secret' values. Inspect network traffic for unauthenticated admin token generation attempts. Verify if StaffDeck binds to 0.0.0.0 without proper network restrictions.

Impact Analysis

Attackers can gain full administrative control over any tenant without credentials. They can impersonate the seeded admin account, access all tenant data, create or delete accounts, reset passwords, and steal sensitive information like session transcripts, memories, knowledge bases, and model API credentials.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive data, which could lead to breaches of GDPR (data protection) and HIPAA (health information privacy). Organizations using this software may face legal penalties and reputational damage.

Mitigation Strategies

Immediately update StaffDeck to a patched version beyond 0.5.6. Replace all hard-coded secrets with unique, randomly generated values. Restrict network binding to trusted interfaces instead of 0.0.0.0. Rotate all API keys, credentials, and session secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111636. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart