StaffDeck (<= 0.5.6)

OpenBMB StaffDeck versions through 0.5.6 contain an authentication bypass vulnerability allowing attackers to forge administrator session tokens via a hard-coded app_secret.