OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery (AIDotNet OpenDeepWiki)
En bref
- Source
- NVD
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- VulnCheck
- Statut NVD
- Deferred
Description
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
Faiblesses (CWE)
- CWE-321 — Utilisation d'une clé cryptographique codée en dur
Références
- https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544
- https://github.com/AIDotNet/OpenDeepWiki/issues/403
- https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27
- https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92
- https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery
- https://github.com/AIDotNet/OpenDeepWiki
- https://www.vulncheck.com/advisories/opendeepwiki-through-2.0.6-hard-coded-jwt-signing-key-admin-token-forgery
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | CRITICAL 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
| CVSS 4.0 | CRITICAL 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · disclosure@vulncheck.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · disclosure@vulncheck.com (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-113934
- GCVE · GCVE-0-2026-119597
Produits affectés
| Produit | Versions |
|---|---|
| AIDotNet · OpenDeepWiki | affected 0 ≤ 2.0.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |