CVE-2026-119597

Name of the Vulnerable Software and Affected Versions OpenDeepWiki versions prior to 2.0.7

Description An unauthenticated attacker can forge administrator tokens due to a hard-coded JWT signing key located in the appsettings.json file. By using the publicly known Jwt:SecretKey, an attacker can create HS256 bearer tokens with an Admin role claim. This allows unauthorized access to the /api/admin endpoint, granting full control over users, roles, repositories, settings, and API keys.

Recommendations Update OpenDeepWiki to a version newer than 2.0.6.