CVE-2026-52539

CRITICAL

Outstatic CMS <= 2.1.9 - Unauthenticated JWT Forgery via Hardcoded Signing Secret

Title source: llm

Description

Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT session tokens with arbitrary user data and full administrative permissions.

References (2)

Core 2

Core References

https://github.com/avitorio/outstatic/blob/canary/packages/outstatic/src/utils/constants.ts

https://github.com/avitorio/outstatic

Scores

CVSS v3 9.1

EPSS 0.0030

EPSS Percentile 22.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-798

Status published

Published Jul 30, 2026

Tracked Since Jul 31, 2026