CVE-2026-111636: OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default appsecret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenantdemo' to gain full tenant administration, including stored model and channel credentials.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenBMB StaffDeck versions through 0.5.6 are affected when they use the hard-coded default app_secret. The exposed administrative account is the seeded admin user in the tenant_demo tenant.
What does an attacker need to exploit the vulnerability?
An attacker does not need an existing account or user interaction. They need to forge an HMAC-SHA256 session token using the hard-coded default app_secret for the seeded admin user in tenant_demo.
What access can a successful attacker obtain?
A successful attacker gains full administration of the affected tenant. This includes access to stored model and channel credentials.
How can I determine whether my deployment is at risk?
Check whether the StaffDeck deployment is version 0.5.6 or earlier and whether its app_secret remains set to the hard-coded default. Also determine whether the tenant_demo tenant and its seeded admin account are present.