CVE-2026-119597

CRITICAL 9.8

OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.

CWE	CWE-321
Vendor	aidotnet
Product	opendeepwiki
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for aidotnet opendeepwiki

Be the first to know when new critical vulnerabilities affecting aidotnet opendeepwiki are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

AIDotNet / OpenDeepWiki

0 ≤ 2.0.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544 github.com: https://github.com/AIDotNet/OpenDeepWiki/issues/403 github.com: https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27 github.com: https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92 hackmd.io: https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery github.com: https://github.com/AIDotNet/OpenDeepWiki vulncheck.com: https://www.vulncheck.com/advisories/opendeepwiki-through-2.0.6-hard-coded-jwt-signing-key-admin-token-forgery

Credits

hieuPenguinnn