CVE-2026-111636
CVE-2026-111636 · OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
CVSS 9.2 · Critical · EPSS 0.4%
- Published
- Updated
Affected products and versions
staffdeck
- Versions
- ≥ 0, ≤ 0.5.6: Affected (custom)
No fix published
Original sources
- https://hackmd.io/@hieuPenguinnn/staffdeck-default-token-signing-secret-auth-bypass
- https://github.com/OpenBMB/StaffDeck/blob/v0.5.6/backend/app/config.py#L10
- https://github.com/OpenBMB/StaffDeck/blob/v0.5.6/backend/app/security/auth.py#L96-L98
- https://www.vulncheck.com/advisories/openbmb-staffdeck-through-0.5.6-authentication-bypass-via-hard-coded-session-secret
- https://nvd.nist.gov/vuln/detail/CVE-2026-111636