CVE-2026-0622 Open 5GS WebUI uses a hard-coded JWT signing key
Open 5GS WebUI uses a hard-coded JWT signing key by default, allowing attackers to forge tokens and bypass authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-0622?
CVE-2026-0622 is a medium-severity vulnerability in Open5gs Open5gs, published on 20 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset
Weakness: CWE-798
Which versions are affected by CVE-2026-0622?
It affects 1 product.
Products include Open5gs Open5gs.
How do I fix CVE-2026-0622?
No fix has been published for CVE-2026-0622 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-0622 being exploited?
There is no known exploitation of CVE-2026-0622 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Open5gs Open5gs
Sources
Also known as GHSA-gq23-98cm-xpr9.