VYPR
← All advisories
Critical severity9.8OSV Advisory· Published Jan 22, 2026· Updated Jun 17, 2026

CVE-2026-23958

CVE-2026-23958

Description

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints that verify JWT tokens. The vulnerability has been fixed in v2.10.19. No known workarounds are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Dataease/DataeaseOSV3 versions
    v1.0.0, v2.10.0, v2.10.1, …+ 2 more
    • (no CPE)range: v1.0.0, v2.10.0, v2.10.1, …
    • cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*range: <2.10.19
    • (no CPE)range: <2.10.19

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.