Vendor
Agnaistic Agnai versions 1.0.555 and earlier contain hard-coded administrative credentials and a static JWT secret, enabling unauthenticated account takeover and configuration manipulation.