CVE-2026-0622 - Vulnerability Details - OpenCVE

Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Open5gs	Open5gs

No data.

No data.

References

Link	Providers
https://github.com/open5gs/open5gs/issues/2264
https://github.com/open5gs/open5gs/issues/856
https://github.com/open5gs/open5gs/pull/857
https://www.kb.cert.org/vuls/id/458022

History

Wed, 21 Jan 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 21 Jan 2026 11:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Open5gs Open5gs open5gs
Vendors & Products		Open5gs Open5gs open5gs

Tue, 20 Jan 2026 21:30:00 +0000

Type	Values Removed	Values Added
References		https://www.kb.cert.org/vuls/id/458022

Tue, 20 Jan 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset
Title		Open 5GS WebUI uses a hard-coded JWT signing key
References		https://github.com/open5gs/open5gs/issues/2264 https://github.com/open5gs/open5gs/issues/856 https://github.com/open5gs/open5gs/pull/857

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2026-01-20T19:56:04.996Z

Updated: 2026-01-21T16:47:50.399Z

Reserved: 2026-01-05T20:12:06.482Z

Link: CVE-2026-0622

Vulnrichment

Updated: 2026-01-20T20:27:10.033Z

NVD

Status : Received

Published: 2026-01-20T20:16:01.483

Modified: 2026-01-21T17:16:07.390

Link: CVE-2026-0622

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0622", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-01-05T20:12:06.482Z", "datePublished": "2026-01-20T19:56:04.996Z", "dateUpdated": "2026-01-21T16:47:50.399Z"}, "containers": {"cna": {"title": "Open 5GS WebUI uses a hard-coded JWT signing key", "descriptions": [{"lang": "en", "value": "Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset"}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "NewPlane", "product": "open5GS", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "2.7.6", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "references": [{"url": "https://github.com/open5gs/open5gs/issues/2264"}, {"url": "https://github.com/open5gs/open5gs/issues/856"}, {"url": "https://github.com/open5gs/open5gs/pull/857"}], "x_generator": {"engine": "VINCE 3.0.31", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-0622"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-01-20T19:59:58.794Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/458022"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-20T20:27:10.033Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T16:47:23.984803Z", "id": "CVE-2026-0622", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T16:47:50.399Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/458022"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-20T20:27:10.033Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0622", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T16:47:23.984803Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T16:47:46.195Z"}}], "cna": {"title": "Open 5GS WebUI uses a hard-coded JWT signing key", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "NewPlane", "product": "open5GS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.7.6"}]}], "references": [{"url": "https://github.com/open5gs/open5gs/issues/2264"}, {"url": "https://github.com/open5gs/open5gs/issues/856"}, {"url": "https://github.com/open5gs/open5gs/pull/857"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.31", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-0622"}, "descriptions": [{"lang": "en", "value": "Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-01-20T19:59:58.794Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0622", "state": "PUBLISHED", "dateUpdated": "2026-01-21T16:47:50.399Z", "dateReserved": "2026-01-05T20:12:06.482Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-01-20T19:56:04.996Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}