CVE Intelligence

Openbmb StaffDeck vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Openbmb StaffDeck: 1 record(s), with affected versions and fixes.

CVE-2026-111636 High · 8.1 CWE-321 Oct 16, 2026
OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.