Live › vulnerability › CVE-2026-111636
Go to dashboardOpenBMB StaffDeck through 0.5.6 signs session tokens with a hard-coded default app_secret. An unauthenticated attacker can forge an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' and gain full tenant administration, including stored model and channel credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
0.5.6 and earlier are affected per the sources)0.5.6 once the vendor publishes oneEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-111636")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.