https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 16:07:20 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-111636 <p>OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded &#39;admin&#39; user in &#39;tenant_demo&#39; to gain full tenant administration, including stored model and channel credentials.</p> <p>OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded &#39;admin&#39; user in &#39;tenant_demo&#39; to gain full tenant administration, including stored model and channel credentials.</p> https://db.gcve.eu/vuln/fkie_cve-2026-111636 https://db.gcve.eu/vuln/ghsa-m82j-2j7c-gx6q <p>OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded &#39;admin&#39; user in &#39;tenant_demo&#39; to gain full tenant administration, including stored model and channel credentials.</p> <p>OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded &#39;admin&#39; user in &#39;tenant_demo&#39; to gain full tenant administration, including stored model and channel credentials.</p> https://db.gcve.eu/vuln/ghsa-m82j-2j7c-gx6q