VYPR
← All advisories
Unrated severityOSV Advisory· Published Jan 22, 2026· Updated Jan 26, 2026

DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover

CVE-2026-23958

Description

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints that verify JWT tokens. The vulnerability has been fixed in v2.10.19. No known workarounds are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Dataease/DataeaseOSV2 versions
    v1.0.0, v2.10.0, v2.10.1, …+ 1 more
    • (no CPE)range: v1.0.0, v2.10.0, v2.10.1, …
    • (no CPE)range: <2.10.19

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.