Staffdeck
Monthly
Authentication bypass in OpenBMB StaffDeck through 0.5.6 lets unauthenticated attackers forge valid administrator session tokens by signing an HMAC-SHA256 token with the hard-coded default app_secret shipped in backend/app/config.py, targeting the seeded 'admin' user in the 'tenant_demo' tenant. Successful exploitation grants full tenant administration, including access to stored model and channel credentials; the assessed CVSS 3.1 score is 9.2 (Critical) with AV:N/PR:N/UI:N but AC:H/AT:P, because only deployments that have not rotated the default secret and that still retain the demo tenant and admin account are affected. No public exploit identified at time of analysis, and no CISA KEV entry or vendor-patched version was provided in the source data.
Authentication bypass in OpenBMB StaffDeck through 0.5.6 lets unauthenticated attackers forge valid administrator session tokens by signing an HMAC-SHA256 token with the hard-coded default app_secret shipped in backend/app/config.py, targeting the seeded 'admin' user in the 'tenant_demo' tenant. Successful exploitation grants full tenant administration, including access to stored model and channel credentials; the assessed CVSS 3.1 score is 9.2 (Critical) with AV:N/PR:N/UI:N but AC:H/AT:P, because only deployments that have not rotated the default secret and that still retain the demo tenant and admin account are affected. No public exploit identified at time of analysis, and no CISA KEV entry or vendor-patched version was provided in the source data.