OpenDeepWiki Hard-Coded JWT Key Lets Attackers Forge Admin Tokens

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json.

Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control:

• users
• roles
• repositories
• settings
• API keys