CVE-2026-119597

The record

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.

Affected packages

Related vulnerabilities

• CVE-2026-61737 ng-antd-admin is an Angular and NestJS administration system template. CWE-321
• CVE-2026-91912 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded… CWE-321
• CVE-2025-62841 An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3… CWE-321
• CVE-2025-62839 An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3… CWE-321
• CVE-2026-86384 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-321
• CVE-2026-102812 A hard-coded cryptographic key vulnerability exists in the user-configuration backup… CWE-321
• CVE-2026-117564 nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows… CWE-321
• CVE-2026-111460 A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. CWE-321