Skip to main content

CISA advises on Open5GS WebUI default JWT secret

Source Decision Insights Threat Desk Published January 20, 2026 Companies 3
Human View Machine View

3 companies named across 10 categories, one of 7 articles referencing Node.js. Previous coverage: CISA alerts on code injection in binary-parser library (Jan 2026).

Companies mentioned

Best suited for

Seniority
Staff
Job function
Application Management / Integration / Middleware
Persona
Platform / Infrastructure Engineer
Buyer role
Technical Implementer / Administrator
Decision stage
Post Buy
Adoption curve
Early Majority
Industry
Telecommunication Services / Wireless Telecommunication Services / Mobile Network Operators

Our classification, not the publisher's statement. Best suited for, not only for.

The Open5GS WebUI component, implemented with Node.js and Next.js for managing 5G core configuration and subscriber data, uses default hardcoded secrets for security-sensitive operations including JSON Web Token signing, enabling an attacker with network access to forge authentication tokens and obtain administrative access to the WebUI and its management endpoints.

CVE-2026-0622 documents that the WebUI relies on Node.js process.env variables, including process.env.SECRET_KEY and process.env.JWT_SECRET_KEY, that are initialized by default to the static value “change-me”. The component issues and validates JSON Web Tokens (JWTs) using the default hardcoded secret unless the executing environment explicitly overrides those variables, and the WebUI on startup does not emit warnings or enforce changes to these defaults. The advisory notes the WebUI is commonly deployed containerized or assumed locally exposed.

An unauthenticated network attacker with access to the WebUI can generate forged JWTs using the known default secret and use those tokens to access or modify Representational State Transfer (REST) endpoints under /api/db/*. This allows unauthorized read and write access to sensitive data, including subscriber information and system configuration, and Cross-Site Request Forgery (CSRF) protections do not mitigate requests authenticated with valid forged JWTs. Successful exploitation may result in full access of the WebUI component and all of its permissions.

A patch addressing the issue is available in pull request https://github.com/open5gs/open5gs/pull/4279 against version v2.7.6 released in July 2025; the patch adds a self-contained .env file for the WebUI’s Next.js environment and removes reliance on hardcoded default secret values so each WebUI deployment generates and uses independent, locally scoped cryptographic secrets. Developers integrating or redistributing the WebUI are encouraged to evaluate, validate, and adopt the changes prior to deployment.

Users unable to apply the patch are instructed to manually configure their Node.js environment to define strong, cryptographically secure random values for process.env.SECRET_KEY and process.env.JWT_SECRET_KEY that are unique per deployment and treated as sensitive secrets, and operators are advised to restrict exposure of the WebUI by placing it behind network controls such as authentication gateways or secure content inspection proxies.

Blog post, originally published by Laurie Tyzenhaus at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-advises-on-open5gs-webui-default-jwt-secret/",
        "name": "CISA advises on Open5GS WebUI default JWT secret",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-advises-on-open5gs-webui-default-jwt-secret/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/the-node-foundation/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/the-node-foundation/",
      "name": "Node.js"
    },
    "articleSection": [
      "AI infrastructure",
      "Cybersecurity",
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Staff"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Application Management / Integration / Middleware"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Platform / Infrastructure Engineer"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Telecommunication Services / Wireless Telecommunication Services / Mobile Network Operators"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:47:32-06:00",
    "datePublished": "2026-01-20T14:26:09-07:00",
    "description": "Open5GS WebUI default JWT secrets allow token forgery; patch available in PR against v2.7.6. Primary keyword: Open5GS WebUI",
    "headline": "CISA advises on Open5GS WebUI default JWT secret",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Laurie Tyzenhaus"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/458022"
    },
    "keywords": [
      "Authentication",
      "Cross-Site Request Forgery",
      "JSON",
      "Node",
      "Patch",
      "Representational State Transfer",
      "Tokens"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-advises-on-open5gs-webui-default-jwt-secret/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/next-powered-by-naec/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/next-powered-by-naec/",
        "name": "NEXT POWERED BY NAEC"
      },
      {
        "@id": "https://decisioninsights.ai/registry/the-node-foundation/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/the-node-foundation/",
        "name": "Node.js"
      },
      {
        "@id": "https://decisioninsights.ai/projects/next.js/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/next.js/",
        "name": "Next.js"
      },
      {
        "@type": "SoftwareSourceCode",
        "name": "Node.js"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages