Live › vulnerability › CVE-2026-119597
OpenDeepWiki ships a publicly known JWT signing key in appsettings.json, so anyone can sign their own HS256 token with an Admin role. That token opens the /api/admin endpoints to change users, roles, repositories, settings and API keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Any OpenDeepWiki deployment through version 2.0.6 that uses the default JWT secret in appsettings.json is exposed, and the admin API is the main target. Instances that replaced the signing key with a private secret, or that keep the admin API off the internet, are less exposed. The sources do not say which configurations were tested.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| OpenDeepWiki | github | <= 2.0.6 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-119597")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.