Cve-2026-119597 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-119597/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 17:35:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenDeepWiki: Hard-coded JWT signing key vulnerability (CVE-2026-119597)https://feed.craftedsignal.io/briefs/2026-10-opendeepwiki-jwt-key/Fri, 30 Oct 2026 17:35:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-opendeepwiki-jwt-key/OpenDeepWiki versions up to 2.0.6 include a hard-coded JWT signing key, allowing unauthenticated attackers to forge administrative tokens and gain full application control.OpenDeepWiki versions 2.0.6 and earlier contain a critical vulnerability due to a hard-coded JWT signing key ('Jwt:SecretKey') located in the 'appsettings.json' configuration file. This flaw permits unauthenticated remote actors to forge HS256-signed bearer tokens. By asserting an 'Admin' role claim in the forged token, attackers can authenticate to protected '/api/admin' endpoints and perform privileged operations, including user account manipulation, repository modification, and API key management.

Impact

Successful exploitation results in full administrative compromise of the OpenDeepWiki instance, allowing unauthorized access to all user data, configuration settings, and connected repositories.

Recommendation

  1. Inventory all instances of OpenDeepWiki currently running version 2.0.6 or earlier.
  2. Implement an emergency patch or upgrade to the version resolving this vulnerability (if available) or transition the application to an isolated network segment immediately.
  3. Rotate the JWT secret immediately upon applying a patch, as the hard-coded key is publicly documented.
  4. Hunt for anomalous administrative activity in application logs targeting '/api/admin' routes originating from non-authorized user sessions or unrecognized IP addresses.
]]>criticaladvisoryauthenticationweb-applicationcve-2026-119597