CVE-2026-111636: Use of Hard-coded Cryptographic Key in OpenBMB StaffDeck

CVE-2026-111636 describes a critical authentication bypass vulnerability in OpenBMB StaffDeck through version 0.5.6. The vulnerability arises from the use of a hard-coded default app_secret cryptographic key. Attackers can exploit this by forging HMAC-SHA256 tokens for the seeded 'admin' user in the 'tenant_demo' tenant, thereby gaining full administrative privileges over the tenant, including access to sensitive stored credentials. The CVSS 4.0 base score is 9.2, indicating critical severity with network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and gain full administrative access to a tenant within StaffDeck. This includes control over stored model and channel credentials, potentially leading to further compromise of tenant resources and data confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to vulnerable versions and monitor for suspicious activity related to forged tokens.