openbmb/staffdeck vulnerabilities

Latest openbmb/staffdeck CVEs

Newest publication first

1. CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

   Published 2026-10-16

   Critical·CVSS 9.2 EPSS 0.40%

   OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.