StaffDeck vulnerabilities

CVEs whose affected-version data names the StaffDeck package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111636High· 8.1

yesterday

OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token …

▾ TwilightOpenBMB · StaffDeckvia CVEORG