CVE-2026-0622

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0622", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-01-05T20:12:06.482Z", "datePublished": "2026-01-20T19:56:04.996Z", "dateUpdated": "2026-01-21T16:47:50.399Z"}, "containers": {"cna": {"title": "Open 5GS WebUI uses a hard-coded JWT signing key", "descriptions": [{"lang": "en", "value": "Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset"}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "NewPlane", "product": "open5GS", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "2.7.6", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "references": [{"url": "https://github.com/open5gs/open5gs/issues/2264"}, {"url": "https://github.com/open5gs/open5gs/issues/856"}, {"url": "https://github.com/open5gs/open5gs/pull/857"}], "x_generator": {"engine": "VINCE 3.0.31", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-0622"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-01-20T19:59:58.794Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/458022"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-20T20:27:10.033Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T16:47:23.984803Z", "id": "CVE-2026-0622", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T16:47:50.399Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/458022"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-20T20:27:10.033Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0622", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T16:47:23.984803Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T16:47:46.195Z"}}], "cna": {"title": "Open 5GS WebUI uses a hard-coded JWT signing key", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "NewPlane", "product": "open5GS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.7.6"}]}], "references": [{"url": "https://github.com/open5gs/open5gs/issues/2264"}, {"url": "https://github.com/open5gs/open5gs/issues/856"}, {"url": "https://github.com/open5gs/open5gs/pull/857"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.31", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-0622"}, "descriptions": [{"lang": "en", "value": "Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-01-20T19:59:58.794Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0622", "state": "PUBLISHED", "dateUpdated": "2026-01-21T16:47:50.399Z", "dateReserved": "2026-01-05T20:12:06.482Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-01-20T19:56:04.996Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "open5GS", "vendor": "NewPlane", "versions": [{"lessThanOrEqual": "2.7.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*", "matchCriteriaId": "9C77332A-BAA3-4FE7-A237-B87F175C6F48", "versionEndIncluding": "2.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset"}, {"lang": "es", "value": "La WebUI de Open 5GS utiliza una clave de firma JWT embebida (c\u00e1mbiame) siempre que la variable de entorno JWT_SECRET_KEY no est\u00e1 definida."}], "id": "CVE-2026-0622", "lastModified": "2026-06-17T10:11:06.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0622", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-21T16:47:23.984803Z", "version": "2.0.3"}}]}, "published": "2026-01-20T20:16:01.483", "references": [{"source": "cret@cert.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://github.com/open5gs/open5gs/issues/2264"}, {"source": "cret@cert.org", "tags": ["Issue Tracking"], "url": "https://github.com/open5gs/open5gs/issues/856"}, {"source": "cret@cert.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/open5gs/open5gs/pull/857"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.kb.cert.org/vuls/id/458022"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:45:36.003580+00:00", "value": {"mitigation_remediation": ["Set the JWT_SECRET_KEY environment variable to a strong, unique key before starting the open5GS WebUI service to prevent the hard\u2011coded key from being used", "Apply the latest kernel or Open 5GS patch that removes the hard\u2011coded JWT secret key and implements secure key management", "Restart the Open 5GS WebUI service after applying the variable change or patch to ensure the new configuration takes effect"], "summary": {"action": "Immediate Patch", "impact": "Unauthorized access or privilege escalation via WebUI authentication"}, "threat_synthesis": {"affected_systems": "Affected systems include the Open 5GS WebUI service provided by NewPlane:open5GS. Any deployment of open5GS that does not explicitly define JWT_SECRET_KEY at launch is susceptible. Version information is not specified in the advisory, implying all current releases that use the default hard\u2011coded key are at risk.", "description_and_impact": "The vulnerability lies in the Open 5GS WebUI component that falls back to a hard\u2011coded JWT signing key (\u201cchange\u2011me\u201d) when the environment variable JWT_SECRET_KEY is not set. This flaw allows an attacker to forge valid JSON Web Tokens without needing valid credentials. The attacker can then authenticate as the WebUI administrator and read, modify, or delete network configuration and subscriber data. The weakness is identified as CWE\u2011798: Hard\u2011coded cryptographic key, and the impact is a loss of authentication integrity, potentially leading to full control over the 5G core network.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low current probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation is straightforward: an attacker with network access to the WebUI can construct a JWT signed with the known key and gain administrator privileges without needing to bypass any other authentication mechanism. Because the flaw resides in the default key logic, it can be triggered immediately without additional configuration changes on the target system."}}}}, "created": "2026-01-21T11:18:40.097845+00:00", "updated": "2026-04-18T04:45:36.869210+00:00", "vendors": ["open5gs", "open5gs$PRODUCT$open5gs"]}