Filtered by vendor Aidotnet Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-119597 1 Aidotnet 1 Opendeepwiki 2026-10-31 9.8 Critical
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.