OpenDeepWiki versions up to 2.0.6 embed a constant JWT signing key in the configuration file. Because the key is publicly known, an unauthenticated attacker can generate a HS256 bearer token that claims the Admin role. The forged token can be used against the /api/admin endpoints, allowing the attacker to create, modify, and delete users, roles, repositories, settings, and API keys. This grants full administrative control over the application and can lead to data loss, manipulation, or further exploitation of the host system.

The vulnerability affects AIDotNet’s OpenDeepWiki up to and including version 2.0.6. The hard‑coded key resides in the appsettings.json file and the fault is present in the Program.cs assembly used by all releases prior to 2.0.7.

The CVSS score of 9.3 classifies this flaw as critical. The EPSS score is not available, but because the attack requires no credentials and only the publicly known key, the likelihood of exploitation is high. The flaw is not listed in CISA’s KEV catalog. An attacker can obtain an admin token by constructing a JWT, then send HTTP requests to privileged API endpoints and fully control the application.