OpenBMB StaffDeck 0.5.6 Critical Auth Bypass Exposes Admin Tokens
Unauthenticated attackers can forge admin session tokens in OpenBMB StaffDeck versions up to 0.5.6, granting full tenant administration access via a hard-coded secret.
Key points
- CVE-2026-111636 is rated Critical with a CVSS score of 9.2.
- The flaw affects OpenBMB StaffDeck versions through 0.5.6.
- Attackers can exploit a hard-coded app_secret to bypass authentication.
OpenBMB StaffDeck versions up to 0.5.6 are affected by a critical authentication bypass vulnerability. The National Vulnerability Database records this flaw as CVE-2026-111636 with a CVSS score of 9.2. The source material does not confirm the availability of a patched version. Managed service providers must verify if their clients run these specific versions.
How it unfolded
- The National Vulnerability Database published CVE-2026-111636 for OpenBMB StaffDeck.
- The record identifies a critical authentication bypass in versions through 0.5.6.
- The flaw allows unauthenticated token forgery using a hard-coded secret.
Who is affected
Organizations running OpenBMB StaffDeck through version 0.5.6 are directly affected. The vulnerability is rated Critical by the NVD. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo'. This grants full tenant administration privileges. The exposure includes stored model and channel credentials. Systems using later versions are not listed as affected.
Our take on the response
The use of a hard-coded default app_secret is a significant design failure. It allows complete authentication bypass without network exploitation or social engineering. The NVD classifies this as CWE-321, indicating a cryptographic issue. This suggests the vendor relied on a static secret for session validation. Such implementation choices often persist in development environments. Moving these to production without rotation creates immediate risk.
Who needs to act first
Teams should prioritize systems exposed to untrusted networks. Check whether any instances of OpenBMB StaffDeck are accessible from the internet. Isolate affected networks if possible to limit lateral movement. Verify if the 'tenant_demo' tenant exists in production environments. If it does, restrict access to that tenant immediately. Monitor logs for unusual administrative activity. Back up configurations before making any changes. Wait for an official vendor update before applying patches.
Background: Social engineering
Social engineering tactics manipulate human psychology to bypass technical security controls. Attackers use urgency, authority, or empathy to trick victims into revealing sensitive data or performing actions. You defend against these methods by verifying identity through out-of-band channels and validating requests before execution.
Read the full guide: Social Engineering Tactics: How Attackers Bypass Technical Defenses
What to do and how to stay safe: OpenBMB StaffDeck
- Review network access controls for OpenBMB StaffDeck instances.
- Monitor authentication logs for forged admin session tokens.
- Disable or restrict the 'tenant_demo' tenant if present.
- Wait for an official vendor update before applying patches.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of OpenBMB StaffDeck are affected?
Versions up to and including 0.5.6 are affected by CVE-2026-111636.
What can attackers do with this vulnerability?
They can forge admin session tokens to gain full tenant administration.
Is there a patch available for CVE-2026-111636?
The source material does not confirm the availability of a patched version.
