Description
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AIDotNet OpenDeepWiki
Default version status: unaffected
0 to ≤ 2.0.6affected
References
- https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544 ↗
- https://github.com/AIDotNet/OpenDeepWiki/issues/403 ↗
- https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27 ↗
- https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92 ↗
- https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery ↗
- https://github.com/AIDotNet/OpenDeepWiki ↗
- https://www.vulncheck.com/advisories/opendeepwiki-through-2.0.6-hard-coded-jwt-signing-key-admin-token-forgery ↗