Outstatic CMS versions up to 2.1.9 embed a hard‑coded JWT signing secret. When the OST_TOKEN_SECRET environment variable is absent, the application falls back to this default value, which is publicly exposed in the source repository. An attacker can craft signed JWTs containing arbitrary user claims and receive full administrative privileges, effectively bypassing authentication and gaining complete control over the system.

All deployments of Avitorio Outstatic CMS 2.1.9 or earlier are affected. If your environment still runs one of these releases, the vulnerability is present and exploitable.

The vulnerability receives a CVSS score of 9.1, indicating a high impact and remote attack vector. The EPSS score is 0.00303 (<1%), suggesting a very low but non‑zero exploitation probability. The flaw is not listed in CISA KEV. An attacker can exploit it remotely by sending a malicious request containing a forged token; no local privilege or user interaction is required, making the risk significant for unpatched installations.