CVE-2026-119597
Critical
Description
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
SeverityCritical
CVSS9.8
Exploit probability—
ProductOpenDeepWiki
PublishedOct 30, 2026
First seenNov 4, 2026
Weakness typeCWE-321CWE-321
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| AIDotNet OpenDeepWiki | v ≤ 2.0.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.