OpenDeepWiki through version 2.0.6 ships a publicly known JWT signing key. According to VulnCheck's advisory, an unauthenticated attacker can use that key to forge administrator tokens and take control of the application's admin functions on any deployment still running with the default key.
What Is It
CVE-2026-119597 is a hard-coded cryptographic key flaw (CWE-321) in AIDotNet's OpenDeepWiki. The Jwt:SecretKey value is set in the project's appsettings.json, and that value is publicly known. Anyone who knows it can sign their own HS256 bearer tokens. VulnCheck reports that an attacker can put an Admin role claim in a forged token and the application will accept it as a real administrator session, as long as the instance has not replaced the default key.
VulnCheck disclosed the issue, and NVD published it on 2026-10-30. The NVD record status is currently "Deferred."
Why It Matters
VulnCheck rates the flaw CVSS 3.1 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 score is 9.3 (Critical). The attack works over the network, needs no privileges or user interaction, and has low complexity.
With a forged admin token, an attacker can reach the /api/admin endpoints and control:
- Users and roles
- Repositories
- Application settings
- API keys
That means full administrative takeover, with high impact to confidentiality, integrity, and availability.
KEV status: As of publication, this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog. KEV does not currently confirm active exploitation. A public technical write-up on the issue is listed in the references.
What's Vulnerable
- Vendor: AIDotNet
- Product: OpenDeepWiki
- Affected versions: all versions through 2.0.6 (semver)
- Repository: github.com/AIDotNet/OpenDeepWiki
The NVD references point to the vulnerable code in v2.0.6: the JWT configuration in Program.cs (line 92) and the hard-coded key in appsettings.json (line 27).
Patch Status
The NVD record does not name a fixed release. It references an upstream commit (1bf0f4b) and GitHub issue #403, which administrators should review for remediation status. CISA has published no KEV required action or due date.
Until a fixed version is confirmed, operators running OpenDeepWiki 2.0.6 or earlier should treat any deployment that uses the default Jwt:SecretKey as exposed to admin token forgery.
Sources
- NVD – CVE-2026-119597
- VulnCheck Advisory – OpenDeepWiki Hard-Coded JWT Signing Key Admin Token Forgery
- CISA Known Exploited Vulnerabilities Catalog
- OpenDeepWiki GitHub Repository
- OpenDeepWiki v2.0.6 – Program.cs#L92
- OpenDeepWiki v2.0.6 – appsettings.json#L27
- OpenDeepWiki Commit 1bf0f4b
- OpenDeepWiki Issue #403
- HackMD Write-up – OpenDeepWiki Hard-Coded JWT Secret Admin Forgery