External risk intelligence

OpenDeepWiki Hard-coded JWT Secret Allows Administrator Token Forgery.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-119597

OpenDeepWiki is a web application platform. The vulnerability allows unauthenticated access to administrative API endpoints. Web applications and their associated API interfaces are commonly deployed as internet-facing services, making them reachable to remote attackers without requiring internal network access.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

OpenDeepWiki versions up to 2.0.6 contain a critical vulnerability where a hard-coded secret key allows unauthenticated attackers to forge administrator tokens, potentially granting them full control over user accounts, settings, and API keys. This issue affects the application's ability to securely authenticate administrative actions.

Attackers can gain admin access.
Hard-coded secrets enable unauthorized control.
Confirm if OpenDeepWiki is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing the application's configuration file and discovering a hard-coded secret key. This key allows them to create a forged administrator token, which they can then use to access sensitive administrative functions within the application.

Unauthenticated network access required.
Forging administrator tokens using a public secret.
Full administrative control over the application.

Live Threat

Current exploitation, exposure, and threat context

A hard-coded JWT signing key in OpenDeepWiki allows unauthenticated attackers to forge administrator tokens. This could enable unauthorized access to administrative API endpoints, potentially affecting user management, repository controls, and system settings.

User and system data at risk.
Forged tokens grant administrative access.
Unauthorized control over platform features.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical vulnerability in OpenDeepWiki, stemming from a hard-coded JWT signing key, allows unauthenticated attackers to forge administrator tokens and gain full control over the application. This means the platform or application owner is primarily responsible for remediation, necessitating an immediate inventory of all OpenDeepWiki instances, confirmation of their exposure and criticality, and prioritization of affected systems for intervention.

Platform/Application owners
Verify instance reachability and criticality.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenDeepWiki?

OpenDeepWiki is a web-based platform designed for managing knowledge repositories and collaborative documentation. It functions as an application server that handles user accounts, system roles, and API integrations. Because it centralizes organizational information, it is often deployed to provide internal or external teams with a unified interface for content management and administrative workflows.

What does CVE-2026-119597 mean?

This CVE describes a critical weakness known as CWE-321: Use of a Hard-coded Cryptographic Key. In OpenDeepWiki, the secret key used to sign JSON Web Tokens (JWTs) is hard-coded within the application's configuration file. Because this secret is fixed and publicly discoverable, anyone can use it to mathematically generate their own valid authentication tokens, tricking the system into granting them unrestricted administrative privileges.

How can an attacker trigger this vulnerability?

An attacker triggers this by obtaining the hard-coded secret key from the application's configuration. Once they have this key, they can craft custom tokens that claim an 'Admin' role and sign them using the secret. They do not need to provide a username or password to the login screen. It is important to note that this bug is not triggered by normal user activity; it requires the attacker to actively forge a malicious token and present it to administrative API endpoints.

Is my deployment at risk according to Halo Surface Signal?

Yes, if your instance is reachable over the network. Halo Surface Signal identifies OpenDeepWiki as a web application platform where administrative API interfaces are often exposed to the internet. Because the vulnerability allows unauthenticated remote access, any instance accessible from outside your internal network—or even reachable by unauthorized users within your network—is considered highly susceptible to compromise.

What should I do if I am running OpenDeepWiki?

First, conduct an inventory to identify all active instances of OpenDeepWiki within your environment. Verify whether these instances are internet-facing or accessible to untrusted users. Since the issue stems from a hard-coded secret, immediately review the application's configuration files and documentation to understand how to rotate or update the authentication keys according to the vendor's secure configuration guidelines.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.