StaffDeck (<= 0.5.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/staffdeck--0.5.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 18:47:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-111636: Authentication Bypass in OpenBMB StaffDeckhttps://feed.craftedsignal.io/briefs/2026-10-openbmb-staffdeck-auth-bypass/Fri, 16 Oct 2026 18:47:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-openbmb-staffdeck-auth-bypass/OpenBMB StaffDeck versions through 0.5.6 contain an authentication bypass vulnerability allowing attackers to forge administrator session tokens via a hard-coded app_secret.OpenBMB StaffDeck through version 0.5.6 contains a critical authentication bypass vulnerability (CVE-2026-111636) resulting from the use of a hard-coded default application secret. Because this secret is embedded in the application code rather than dynamically generated, an unauthenticated attacker can perform unauthorized HMAC-SHA256 signing of session tokens. By crafting a token for the 'admin' user within the 'tenant_demo' context, an attacker can bypass all authentication mechanisms to obtain full administrative access to the platform. This access allows the actor to manage stored model configurations and sensitive channel credentials, leading to full tenant compromise. Given the ease of exploitation, this vulnerability poses a significant risk to the confidentiality and integrity of deployments.

Impact

Successful exploitation grants an attacker full administrative control over a StaffDeck tenant. Impacted organizations face potential exfiltration of sensitive model data, compromise of channel integration credentials, and unauthorized control over platform operations. The severity is marked as high (CVSS 8.1), reflecting the potential for complete account takeover and data breach within affected environments.

Recommendation

Prioritize the immediate update of all StaffDeck instances to a version beyond 0.5.6 that resolves the hard-coded secret vulnerability. As a temporary mitigation, ensure that the application is not exposed to the public internet and verify that the 'tenant_demo' is not utilized in production environments.

]]>highadvisory