CVE-2026-52539

Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT session tokens with arbitrary user data and full administrative permissions.

• CWE-798

• https://github.com/avitorio/outstatic
• https://github.com/avitorio/outstatic/blob/canary/packages/outstatic/src/utils/constants.ts

Published

Jul 30, 2026

Last Modified

Jul 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5251A vulnerability was identified in z-9527 admin 1.0/2.0. This…6.3
• CVE-2026-5252A security flaw has been discovered in z-9527 admin 1.0/2.0.…3.5
• CVE-2026-52520Emlog CMS <= 2.6.14 contains a stored cross-site scripting (…5.4
• CVE-2026-52521A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows auth…8.1
• CVE-2026-5253A weakness has been identified in bufanyun HotGo 1.0/2.0. Af…3.5
• CVE-2026-52533An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an …9.8
• CVE-2026-5254A security vulnerability has been detected in welovemedia FF…3.5
• CVE-2026-5255A vulnerability was detected in code-projects Simple Laundry…6.1
• CVE-2026-5256A flaw has been found in code-projects Simple Laundry System…9.8
• CVE-2026-5257A vulnerability has been found in code-projects Simple Laund…9.8
• CVE-2026-5258A vulnerability was found in Sanster IOPaint 1.5.3. Impacted…7.3
• CVE-2026-52584Buffer Overflow vulnerability in libjxl v.0.11.2 and before …7.1