{"id":"CVE-2026-119597","kind":"vulnerability","aliases":["CVE-2026-119597"],"related":[],"title":"OpenDeepWiki: hard-coded JWT key lets anyone forge admin tokens","description":"OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.","summary":"OpenDeepWiki ships a publicly known JWT signing key in appsettings.json, so anyone can sign their own HS256 token with an Admin role. That token opens the /api/admin endpoints to change users, roles, repositories, settings and API keys.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenDeepWiki","fixed":[],"affected":"<= 2.0.6","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","dotnet","jwt","opendeepwiki","self-hosted"],"not_affected_if":["admin-api-not-exposed","custom-jwt-secret"],"how_to_check":"- Check the deployed version: 2.0.6 or earlier is in scope per NVD.\n- Check whether Jwt:SecretKey in appsettings.json, or the JWT_SECRET_KEY environment variable, is empty, the shipped default, or a private random value. A private value of your own means forged tokens will not validate.\n- Check whether /api/admin is reachable from untrusted networks.","fix":null,"status":"open","published_at":"2026-10-30T14:16:47+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","triaged_at":"2026-10-30T14:32:32+00:00","updated_at":"2026-10-30T14:34:13+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-30T14:32:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenDeepWiki: hard-coded JWT key lets anyone forge admin tokens","impact":"high","summary":"OpenDeepWiki ships a publicly known JWT signing key in appsettings.json, so anyone can sign their own HS256 token with an Admin role. That token opens the /api/admin endpoints to change users, roles, repositories, settings and API keys.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["opendeepwiki","self-hosted","jwt","dotnet"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker becomes administrator and controls users, repositories, and API keys.","analyst_note":"Confirm the fixed version and whether the default key is still shipped in newer releases, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119597.","how_to_check":"- Look for `Jwt:SecretKey` in `appsettings.json` and check whether the value is the default shipped key.\n- Check whether the deployed OpenDeepWiki version is `2.0.6` or earlier.\n- Check whether `/api/admin` is reachable from the internet.","plain_action":"","needs_analyst":true,"not_affected_if":["custom-jwt-secret","admin-api-not-exposed"],"who_is_affected":"Any OpenDeepWiki deployment through version 2.0.6 that uses the default JWT secret in appsettings.json is exposed, and the admin API is the main target. Instances that replaced the signing key with a private secret, or that keep the admin API off the internet, are less exposed. The sources do not say which configurations were tested.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000734,"input_tokens":4173,"output_tokens":634,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the default key is still shipped in newer releases, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119597.","search":"'-119597':14A,17A '-2026':13A,16A '/api/admin':54B,106C '2.0.6':67C 'access':105C 'admin':10A,48B,101C 'administr':83C 'ai':20B 'ai-tool':19B 'allow':78C 'anyon':8A,39B 'api':63B,115C 'appsettings.json':37B,92C 'attack':80C,93C 'bearer':97C 'chang':57B 'claim':103C 'code':4A,72C 'contain':68C 'control':109C 'cve':12A,15A 'dotnet':22B 'endpoint':55B,107C 'forg':9A,82C 'hard':3A,71C 'hard-cod':2A,70C 'host':27B 'hs256':44B,96C 'jwt':5A,23B,33B,73C,89C 'key':6A,35B,64B,75C,116C 'known':32B,88C 'let':7A 'mint':95C 'open':52B 'opendeepwiki':1A,18A,24B,28B,65C 'public':31B,87C 'repositori':60B,112C 'role':49B,59B,102C,111C 'secretkey':90C 'self':26B 'self-host':25B 'set':61B,113C 'ship':29B 'sign':34B,41B,74C 'token':11A,45B,51B,84C,98C 'tool':21B 'unauthent':79C 'use':85C 'user':58B,110C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Any OpenDeepWiki deployment through version 2.0.6 that uses the default JWT secret in appsettings.json is exposed, and the admin API is the main target. Instances that replaced the signing key with a private secret, or that keep the admin API off the internet, are less exposed. The sources do not say which configurations were tested.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119597","severity":null,"published_at":"2026-10-30T14:16:47+00:00","modified_at":"2026-10-30T14:16:47+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","fetched_at":"2026-10-30T14:30:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119597:1160","url":null,"severity":null,"published_at":"2026-10-30T14:34:13+00:00","modified_at":"2026-10-30T14:34:13+00:00","first_seen_at":"2026-10-30T14:34:13+00:00","fetched_at":"2026-10-30T14:34:13+00:00","note":"NVD page unreadable via tools; no vendor advisory or fixed release found. Latest release is v2.0.6 (8 Sep), the same version the CVE lists as affected, so no release is known fixed. Current main appsettings.json has Jwt:SecretKey empty (the 'built-in dev key' the docs mention is not visible in that file), so the default key may live in code or an older file. Not verified. Settle it by finding the maintainer's issue or commit, or a release after 2.0.6. Workaround from the docs: set a strong JWT_SECRET_KEY in production, which the docs say must be changed."}],"documents":[{"id":23984,"url":"https://github.com/AIDotNet/OpenDeepWiki/releases","title":"OpenDeepWiki releases (latest v2.0.6, 8 Sep)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":23985,"url":"https://raw.githubusercontent.com/AIDotNet/OpenDeepWiki/main/src/OpenDeepWiki/appsettings.json","title":"OpenDeepWiki main appsettings.json (Jwt:SecretKey empty)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}