CVE-2026-23958

Description

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints that verify JWT tokens. The vulnerability has been fixed in v2.10.19. No known workarounds are available.

PUBLISHED Reserved 2026-01-19 | Published 2026-01-22 | Updated 2026-01-26 | Assigner GitHub_M

Problem types

CWE-522: Insufficiently Protected Credentials

Product status

References

www.ox.security/...g-dataease-cve-2026-23958-admin-takeover/

github.com/...taease/security/advisories/GHSA-5wvm-4m4q-rh7j

cve.org (CVE-2026-23958)

nvd.nist.gov (CVE-2026-23958)

Download JSON