CVE-2026-52539CWE-798hardcoded-credentials

CVE-2026-52539

Critical · published July 31, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT session tokens with arbitrary user data and full administrative permissions.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.9th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-07-31T01:17Z
References (2)
https://github.com/avitorio/outstatic · [email protected]https://github.com/avitorio/outstatic/blob/canary/packages/outstatic/src/utils/constants.ts · [email protected]
EPSS history
Timeline
  • 30 JUL 00:00Z
    Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret
    cvelistv5