CVE-2026-111636
8.1HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-321
Impact
Unauthenticated attackers with network access can bypass authentication to take full control of tenant administration, including stored model and channel credentials. They achieve this by forging HMAC-SHA256 session tokens for the seeded demo admin account.
Root cause
The application hard-codes a default signing key (app_secret) in its configuration instead of requiring a unique secret.
Affected systems
OpenBMB StaffDeck through 0.5.6
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No patched version is specified; change the default app_secret setting in backend/app/config.py (or via its corresponding environment variable) to a strong, randomly generated value and restart the service.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
References
- https://github.com/OpenBMB/StaffDeck/blob/v0.5.6/backend/app/config.py#L10
- https://github.com/OpenBMB/StaffDeck/blob/v0.5.6/backend/app/security/auth.py#L96-L98
- https://hackmd.io/@hieuPenguinnn/staffdeck-default-token-signing-secret-auth-bypass
- https://www.vulncheck.com/advisories/openbmb-staffdeck-through-0.5.6-authentication-bypass-via-hard-coded-session-secret