{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopendeepwikiopendeepwiki/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:opendeepwiki:opendeepwiki:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-119597"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenDeepWiki (\u003c= 2.0.6)"],"_cs_severities":["critical"],"_cs_tags":["authentication","web-application","cve-2026-119597"],"_cs_type":"advisory","_cs_vendors":["OpenDeepWiki"],"content_html":"\u003cp\u003eOpenDeepWiki versions 2.0.6 and earlier contain a critical vulnerability due to a hard-coded JWT signing key ('Jwt:SecretKey') located in the 'appsettings.json' configuration file. This flaw permits unauthenticated remote actors to forge HS256-signed bearer tokens. By asserting an 'Admin' role claim in the forged token, attackers can authenticate to protected '/api/admin' endpoints and perform privileged operations, including user account manipulation, repository modification, and API key management.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative compromise of the OpenDeepWiki instance, allowing unauthorized access to all user data, configuration settings, and connected repositories.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of OpenDeepWiki currently running version 2.0.6 or earlier.\u003c/li\u003e\n\u003cli\u003eImplement an emergency patch or upgrade to the version resolving this vulnerability (if available) or transition the application to an isolated network segment immediately.\u003c/li\u003e\n\u003cli\u003eRotate the JWT secret immediately upon applying a patch, as the hard-coded key is publicly documented.\u003c/li\u003e\n\u003cli\u003eHunt for anomalous administrative activity in application logs targeting '/api/admin' routes originating from non-authorized user sessions or unrecognized IP addresses.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-30T17:35:44Z","date_published":"2026-10-30T17:35:44Z","id":"https://feed.craftedsignal.io/briefs/2026-10-opendeepwiki-jwt-key/","summary":"OpenDeepWiki versions up to 2.0.6 include a hard-coded JWT signing key, allowing unauthenticated attackers to forge administrative tokens and gain full application control.","title":"OpenDeepWiki: Hard-coded JWT signing key vulnerability (CVE-2026-119597)","url":"https://feed.craftedsignal.io/briefs/2026-10-opendeepwiki-jwt-key/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:opendeepwiki:opendeepwiki:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}