PT-2026-116035 · Openbb · Staffdeck
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant demo' to gain full tenant administration, including stored model and channel credentials.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Staffdeck