Skip to content
OpenAdvisories

Product · OpenBMB

StaffDeck

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-111636

    OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

    OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin'…

    OpenBMB StaffDeck