CVE-2026-119597

Summary

OpenDeepWiki through 2.0.6 uses a hard-coded JWT signing key in appsettings.json, allowing unauthenticated attackers to forge valid HS256 bearer tokens with admin privileges and gain full control of the application.

Exploitability

Trivial to exploit; requires only knowledge of the public Jwt:SecretKey value and ability to craft a JWT with an Admin role claim.

Blast radius

Successful exploitation grants unauthenticated remote attackers full administrative control over users, roles, repositories, settings, and API keys.

Detection

Look for JWT tokens signed with a known public secret (e.g., matching the documented Jwt:SecretKey value) in Authorization headers targeting /api/admin endpoints; such tokens are invalid per RFC 7519 when signed with a publicly exposed key.

Prioritized remediation

Upgrade to OpenDeepWiki version 2.0.7 or later, which removes the hard-coded secret and enforces dynamic key generation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.