Vendor
OpenDeepWiki versions up to 2.0.6 include a hard-coded JWT signing key, allowing unauthenticated attackers to forge administrative tokens and gain full application control.