The vulnerability lies in the Open 5GS WebUI component that falls back to a hard‑coded JWT signing key (“change‑me”) when the environment variable JWT_SECRET_KEY is not set. This flaw allows an attacker to forge valid JSON Web Tokens without needing valid credentials. The attacker can then authenticate as the WebUI administrator and read, modify, or delete network configuration and subscriber data. The weakness is identified as CWE‑798: Hard‑coded cryptographic key, and the impact is a loss of authentication integrity, potentially leading to full control over the 5G core network.

Affected systems include the Open 5GS WebUI service provided by NewPlane:open5GS. Any deployment of open5GS that does not explicitly define JWT_SECRET_KEY at launch is susceptible. Version information is not specified in the advisory, implying all current releases that use the default hard‑coded key are at risk.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low current probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is straightforward: an attacker with network access to the WebUI can construct a JWT signed with the known key and gain administrator privileges without needing to bypass any other authentication mechanism. Because the flaw resides in the default key logic, it can be triggered immediately without additional configuration changes on the target system.