Opendeepwiki
Monthly
OpenDeepWiki through 2.0.6 signs HS256 JWT bearer tokens with a hard-coded signing key that is published in src/OpenDeepWiki/appsettings.json and shipped as the default JWT_SECRET_KEY in the project's compose.yaml, compose.pgsql.yaml, Sealos template and publish.bat, so anyone who knows that public string can mint an Administrator token and drive the /api/admin API - creating or modifying users, roles, repositories, global settings and API keys. Exploitation is remote and unauthenticated (CVSS:4.0 9.3, vector PR:N/UI:N) and requires no action from a victim; the sole precondition is that the instance was left running with the shipped default key, meaning out-of-the-box and default Docker Compose deployments are fully compromised while installations that supplied their own strong JWT_SECRET_KEY are not. The issue is rated act_now and fixed upstream in commit 1bf0f4b5ef8d972ca640e5df145b5813a9492544; no CISA KEV entry exists and no verified working exploit code is known, although a public technical writeup demonstrating the administrator-token forgery technique is referenced.
OpenDeepWiki through 2.0.6 signs HS256 JWT bearer tokens with a hard-coded signing key that is published in src/OpenDeepWiki/appsettings.json and shipped as the default JWT_SECRET_KEY in the project's compose.yaml, compose.pgsql.yaml, Sealos template and publish.bat, so anyone who knows that public string can mint an Administrator token and drive the /api/admin API - creating or modifying users, roles, repositories, global settings and API keys. Exploitation is remote and unauthenticated (CVSS:4.0 9.3, vector PR:N/UI:N) and requires no action from a victim; the sole precondition is that the instance was left running with the shipped default key, meaning out-of-the-box and default Docker Compose deployments are fully compromised while installations that supplied their own strong JWT_SECRET_KEY are not. The issue is rated act_now and fixed upstream in commit 1bf0f4b5ef8d972ca640e5df145b5813a9492544; no CISA KEV entry exists and no verified working exploit code is known, although a public technical writeup demonstrating the administrator-token forgery technique is referenced.