OpenBMB StaffDeck: Authentication bypass via hard-coded session signing secret

Summary

OpenBMB StaffDeck through version 0.5.6 uses a hard-coded default app_secret to sign session tokens. An unauthenticated remote attacker who knows this default can forge an HMAC-SHA256 token for the seeded admin user in tenant_demo and gain full tenant administration. This includes access to stored model and channel credentials. The attack requires no user interaction and no prior access, but the vulnerable default must still be in use.

Affected

• OpenBMB StaffDeck 0 to 0.5.6
• Default configuration (app_secret not changed) is affected

Fixed in

Unknown. No fixed version has been confirmed.

Workaround

• Set APP_SECRET to a long random value before first start, after verifying that the code uses this variable (not yet verified)
• Do not change APP_SECRET on an existing installation without a migration plan, because channel credential encryption depends on it
• Restrict network access to the service (LAN or VPN only); do not publish port 5173
• Change the default administrator password (admin/admin)

Exploitation

• VulDB states that no exploit is available (third-party statement)
• No evidence of exploitation in the wild and no CISA KEV listing found
• CISA SSVC: exploitation none, automatable no, technical impact total
• The secret is publicly visible in the source code, so exploitation is technically easy once the default is known

Our recommendation

• Inventory whether StaffDeck is in use, which version runs, and whether it is reachable from the internet
• Remove internet exposure until a fixed version is available
• Replace the default app_secret with a unique random value after testing on a copy
• Change the default admin password and review logs for logins from unknown IP addresses
• Rotate model API keys and channel bot secrets if the instance was exposed
• Check the vendor repository for a fix and update when available

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-111636 reference: StaffDeck config.py at v0.5.6 github.com
• CVE-2026-111636 reference: StaffDeck auth.py at v0.5.6 github.com
• HackMD write-up: StaffDeck default token signing secret auth bypass hackmd.io
• VulnCheck advisory: OpenBMB StaffDeck authentication bypass via hard-coded session secret www.vulncheck.com
• VulDB entry for CVE-2026-111636 vuldb.com
• Mend/Vulners entry for CVE-2026-111636 vulners.com
• StaffDeck project repository github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:21.