CVE-2026-105141: topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials
A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET results in hard-coded credentials. The attack may be launched remotely. Upgrading to version 1.6.0 is sufficient to fix this issue. The patch is identified as fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
topoteretes cogneeto a version that resolves this vulnerability.Fixed in 1.6.0Patch fa65fc0cd86cdba48d19aa76e36be862be982f5d
Event History
Frequently Asked Questions
Which deployments are affected?
topoteretes cognee versions up to and including 1.5.4 are affected in the JWT Signing Key Handler component.
What level of access does an attacker need?
The issue can be exploited remotely and has low attack complexity, but it requires low privileges. No user interaction is required.
What is the recommended remediation?
Upgrade topoteretes cognee to version 1.6.0. The fixing patch is fa65fc0cd86cdba48d19aa76e36be862be982f5d.