OpenBMB StaffDeck CVE-2026-111636

Exploitation requires that the deployment still uses the hard-coded default app_secret shipped in backend/app/config.py (v0.5.6) AND that the seeded 'admin' user within the 'tenant_demo' tenant still exists - both of which are StaffDeck defaults. Given those, an unauthenticated remote attacker can mint a valid HMAC-SHA256 session token (AV:N/PR:N/UI:N). The limiting factors captured by AC:H/AT:P are: operators who rotated/overrode the app_secret or removed the demo tenant/admin account are NOT exploitable, and exploitation is scoped to the 'tenant_demo' tenant's administration (stored model and channel credentials) rather than cross-tenant or host-level compromise.

The CVSS 4.0 base score of 9.2 (Critical) reflects a network-reachable (AV:N), unauthenticated (PR:N), no-user-interaction (UI:N) authentication bypass with full confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H). Crucially, the vector also carries AC:H and AT:P, signalling that successful exploitation depends on specific preconditions rather than being a trivial drive-by - namely that the hard-coded default app_secret is still in place and the seeded 'tenant_demo'/'admin' account exists. Because the default secret is visible directly in the public source tree (config.py line 10 referenced in the CVE), forging a valid HMAC-SHA256 token is cryptographically trivial for any attacker where defaults were not changed, so the AC:H/AT:P should be read as a configuration-dependency gate, not as genuine attacker difficulty. No EPSS score is provided, so exploitation probability cannot be quantified from the input. The CVE is NOT listed in CISA KEV and no POC flag was supplied, though a detailed public technical writeup (hackmd) describes the signing method. Net assessment: this is a genuinely high-severity flaw for any deployment still running defaults, but its real-world priority is tempered by (a) an obscure, low-footprint product and (b) the hard dependency on an unchanged default secret and seeded demo tenant - treat as high priority for StaffDeck operators specifically, lower as a fleet-wide emergency. Missing signals (no EPSS, no KEV, no explicit POC flag) should be confirmed before final triage.

An attacker who reads the open-source default app_secret from the StaffDeck GitHub repository crafts an HMAC-SHA256 session token for the seeded 'admin' user in 'tenant_demo' and presents it to the backend over the network, gaining full tenant administration without any credentials. From there they read stored model and channel credentials. A detailed public technical writeup describing the signing method exists, though no weaponized exploit code was indicated in the input.