CVE-2026-23958: DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover
Vulnerability summary
CVE-2026-23958 is a critical (CVSS 9.8) Insufficiently Protected Credentials vulnerability in dataease. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 44.2% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 22-01-2026PublishedVulnerability first disclosed.
- 26-01-2026Last modifiedVulnerability information updated.
Description
Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints that verify JWT tokens. The vulnerability has been fixed in v2.10.19. No known workarounds are available.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.53% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundDataease
Maturity: poc
Exploit Reference (ox.security)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Dataease1 product
- dataease< 2.10.19
1 vendor · 1 product
References
2 links- github.com/dataease/dataease/security/advisories/GHSA-5wvm-4m4q-rh7jX Refsource CONFIRMExploitVendor Advisory