CVE-2026-119597— OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
Quick assessment
Affected
AIDotNet OpenDeepWiki
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenDeepWiki 2.0.6 及更早版本存在硬编码 JWT 签名密钥漏洞。由于 appsettings.json 中的 Jwt:SecretKey 为公开已知信息，未认证的攻击者可利用该密钥伪造管理员令牌。攻击者能够生成带有管理员角色声明的 HS256 Bearer 令牌，进而访问 /api/admin 端点，并控制用户、角色、仓库、设置及 API 密钥。
Possible ATT&CK Techniques 2 AI
T1078.004 · Cloud Accounts T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-119597
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
Source: CVE Program / CVE List V5
Vulnerability Description
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AIDotNet | OpenDeepWiki | 0 ~ 2.0.6 | - |
|
II. Public POCs for CVE-2026-119597
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-119597
请登录查看更多情报信息。
Other References for CVE-2026-119597 (7)
-
https://github.com/AIDotNet/OpenDeepWiki/issues/403 issue-tracking
-
https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92 technical-description
-
https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-321