Threats tagged 'ghsa-m82j-2j7c-gx6q'

1 threat

Threats tagged 'ghsa-m82j-2j7c-gx6q'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.2	EPSS 0.4%	CVE-2026-111636StaffDeck · Use of Hard-coded Cryptographic Key Critical9.2EPSS 0.4%2026-10-16CVE Database V5CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials. EPSS 0.4%Vulnerability OpenBMB #ghsa-m82j-2j7c-gx6q	CVE Database V5	2026-10-16

Showing 1–1 of 1 result