CVE-2026-0622

Impact

Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/open5gs/open5gs/issues/2264
• https://github.com/open5gs/open5gs/issues/856
• https://github.com/open5gs/open5gs/pull/857
• https://www.kb.cert.org/vuls/id/458022