Vulnerability Report

CVE-2026-23958

Title: JWT Signing Secret Brute-Force in Dataease

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-23958.

CWE Category CWE-522

Published Date Jan 22, 2026

Modified Date Feb 17, 2026

Exploit Status Not Found

Score 8.8 CVSS v4.0

Exploit Probability (EPSS)

0.47%

Vulnerability Summary

CVE-2026-23958: Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints that verify JWT tokens. The vulnerability has been fixed in v2.10.19. No known workarounds are available.

Impacted Vendors

dataease 1

Reference Links

https://github.com/dataease/dataease/security/advisories/GHSA-5wvm-4m4q-rh7j

CVSS v4.0

Source Entity [email protected]

Severity HIGH

8.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.8