Plane shipped default values for SECRET_KEY and LIVE_SERVER_SECRET_KEY in community deployment manifests before version 1.4.0. The hardcoded keys are publicly known and allow an attacker who can read the manifests to forge Django‑signed values, thereby compromising user accounts or forging sessions. The exposed LIVE_SERVER_SECRET_KEY also provides a method to bypass authentication for the live‑service. This flaw represents an insecure default (CWE-798).

The vulnerability affects makeplane’s Plane project management tool. All installations that use the aio/cli community deployment manifests with the default keys and are running any version earlier than 1.4.0 are impacted. The fix is released in 1.4.0. The impacted products are Plane under the community deployment path, with unspecified version detail but any pre‑1.4.0 release.

The CVSS score is 9.8, indicating critical severity. EPSS data is not available, but the lack of offline secrets and the fact that the default keys are contained in publicly visible GitHub repositories suggest a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by simply cloning the repository and extracting the secrets, then using the keys to forge session data or bypass live-service authentication. No known exploitation has been reported yet, but the risk remains high for any deployment that has not overridden the default keys.