OpenDeepWiki: Hard-coded JWT signing key vulnerability (CVE-2026-119597)

OpenDeepWiki versions 2.0.6 and earlier contain a critical vulnerability due to a hard-coded JWT signing key ('Jwt:SecretKey') located in the 'appsettings.json' configuration file. This flaw permits unauthenticated remote actors to forge HS256-signed bearer tokens. By asserting an 'Admin' role claim in the forged token, attackers can authenticate to protected '/api/admin' endpoints and perform privileged operations, including user account manipulation, repository modification, and API key management.

Impact

Successful exploitation results in full administrative compromise of the OpenDeepWiki instance, allowing unauthorized access to all user data, configuration settings, and connected repositories.

Recommendation

1. Inventory all instances of OpenDeepWiki currently running version 2.0.6 or earlier.
2. Implement an emergency patch or upgrade to the version resolving this vulnerability (if available) or transition the application to an isolated network segment immediately.
3. Rotate the JWT secret immediately upon applying a patch, as the hard-coded key is publicly documented.
4. Hunt for anomalous administrative activity in application logs targeting '/api/admin' routes originating from non-authorized user sessions or unrecognized IP addresses.