StaffDeck vulnerabilities

1 known vulnerability in StaffDeck from OpenBMB. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  StaffDeck: Use of Hard-coded Cryptographic Key

  CVE-2026-111636Oct 16, 2026OpenBMB

  OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin'