Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111636— OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

Quick assessment

Affected
OpenBMB StaffDeck
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenBMB StaffDeck 0.5.6 及更早版本存在身份验证绕过漏洞。由于使用了硬编码的默认 ，未经验证的攻击者可伪造管理员会话令牌。攻击者可为 租户中预置的 用户生成 HMAC-SHA256 签名令牌，从而获得完整的租户管理权限，包括访问已存储的模型凭据和频道凭据。

CVSS 8.1 · High EPSS 0.40% · P33

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenBMB StaffDeck ≤ 0.5.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111636

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret
Source: CVE Program / CVE List V5
Vulnerability Description
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenBMB StaffDeck 0 ~ 0.5.6 -

II. Public POCs for CVE-2026-111636

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111636

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-111636 (1)

Proof of Concept for CVE-2026-111636 (1)

Security Blog Posts for CVE-2026-111636 (1)

Other References for CVE-2026-111636 (1)

IV. Related Vulnerabilities

Same vendor: OpenBMB
Same weakness: CWE-321

V. Comments for CVE-2026-111636

No comments yet

Leave a comment