{"id":"CVE-2026-119597","aliases":[],"cve":{"records":[{"id":"CVE-2026-119597","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T11:46:45.299Z","published":"2026-10-30T13:18:17.101Z","modified":"2026-11-05T21:27:33.465Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T13:18:17.101Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-05T21:27:33.465Z"}],"references":[{"url":"https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/AIDotNet/OpenDeepWiki/issues/403","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/AIDotNet/OpenDeepWiki","tags":["product"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/opendeepwiki-through-2.0.6-hard-coded-jwt-signing-key-admin-token-forgery","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-321","description":"Use of Hard-coded Cryptographic Key","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-05T21:27:04.837030Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.","score":9.8,"severity":"critical","published":"2026-10-30T13:18:17.101Z","modified":"2026-11-05T21:27:33.465Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"AIDotNet","name":"OpenDeepWiki","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.6","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119597"}],"remediation":[],"references":["https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544","https://github.com/AIDotNet/OpenDeepWiki/issues/403","https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27","https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92","https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery","https://github.com/AIDotNet/OpenDeepWiki","https://www.vulncheck.com/advisories/opendeepwiki-through-2.0.6-hard-coded-jwt-signing-key-admin-token-forgery"],"sources":[{"name":"CVE","id":"CVE-2026-119597","modified":"2026-11-05T21:27:33.465Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119597"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-11-05T23:45:51.426Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:00:33.590Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T15:15:35.990Z","attemptedAt":"2026-10-30T15:15:35.990Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T15:15:34.458Z","attemptedAt":"2026-10-30T15:15:34.458Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T15:15:34.480Z","attemptedAt":"2026-10-30T15:15:34.480Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T15:15:34.515Z","attemptedAt":"2026-10-30T15:15:34.515Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113934","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113934","modified":"Oct 30, 2026, 1:18:17 PM","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-10-30T15:15:34.480Z"},{"source":"NVD","id":"CVE-2026-119597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119597","modified":"2026-10-30T14:16:47.770","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T15:15:35.990Z"},{"source":"NVD","id":"CVE-2026-119597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119597","modified":"2026-10-30T14:16:47.770","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T15:15:35.990Z"}],"aiSummary":{"text":"OpenDeepWiki versions 2.0.6 and below contain a hard-coded JWT signing key, allowing unauthenticated attackers to forge admin tokens. This vulnerability may allow access to admin endpoints and control of users, roles, and settings. Attackers can create HS256 bearer tokens with an Admin role claim.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T15:01:46.646Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119597"}]}}