OpenBMB StaffDeck versions through 0.5.6 contain an authentication bypass flaw that enables attackers to forge signed session tokens. The application uses a hard‑coded app_secret to create HMAC‑SHA256 tokens for the default 'admin' user in the 'tenant_demo' tenant. By signing a token with this known secret, an attacker can obtain a session that is trusted as an administrator, granting full control over tenant resources, including models and channels.

The vulnerability affects OpenBMB StaffDeck, all installations running version 0.5.6 or earlier. The hard‑coded secret is present in the source code listings available for these releases.

The flaw has a CVSS score of 9.2, indicating high severity. No KEV listing and EPSS data is not available, but the vulnerability can be exercised remotely through web requests that accept signed tokens. Because the secret is embedded in the codebase, an attacker does not require any privileged access or additional credentials to exploit the flaw. The impact can be full tenant administration, making this a critical risk for any exposed instance of StaffDeck.