Authentication Bypass Vulnerability in OpenBMB StaffDeck by OpenBMB

CVE-2026-111636

What is CVE-2026-111636?

OpenBMB StaffDeck versions up to 0.5.6 are susceptible to an authentication bypass that enables unauthorized attackers to create forged administrator session tokens. This vulnerability arises from the use of a hard-coded default app secret, allowing attackers to generate valid HMAC-SHA256 tokens for the 'admin' user in the 'tenant_demo' environment. Successful exploitation grants attackers full administrative privileges, including access to sensitive model and channel credentials.

References