Threats tagged 'ghsa-fc52-73gp-r537'

OpenDeepWiki versions up to 2.0.6 have a vulnerability due to a hard-coded JWT signing key. This flaw allows unauthenticated attackers to forge administrator tokens by using the publicly known Jwt:SecretKey found in appsettings.json. Exploiting this, attackers can create HS256 bearer tokens with admin privileges, enabling full control over administrative API endpoints including user, role, repository, settings, and API key management.