A critical authentication bypass vulnerability in Outstatic CMS allows unauthenticated remote attackers to forge session tokens and gain full administrative control over the application.

The application utilizes a hardcoded JWT signing secret that is exposed within the source code repository. When the OST_TOKEN_SECRET environment variable is absent, the system defaults to this publicly known value, permitting unauthenticated attackers to generate valid administrative session tokens.

The ability for an unauthenticated user to assume administrative privileges poses an extreme risk to data integrity and system confidentiality. A successful exploit grants the attacker complete control over the CMS, enabling unauthorized data modification, account takeover, and potential exfiltration of sensitive information. Given the CVSS score of 9.1, this vulnerability is classified as critical, necessitating immediate intervention to prevent total system compromise.

Immediate Action: Ensure the OST_TOKEN_SECRET environment variable is explicitly set to a strong, unique, and non-default value in all production environments.

Proactive Monitoring: Review authentication and access logs for suspicious administrative logins or tokens that deviate from expected patterns or originate from unknown sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter unauthorized traffic and monitor for patterns indicative of JWT manipulation or token forging attempts.

Public Exploit Available: No

This vulnerability represents a severe security failure that bypasses all intended authentication mechanisms. Administrators must prioritize the immediate configuration of a secure, custom JWT secret to override the vulnerable default behavior. Failure to apply this mitigation leaves the application open to full administrative takeover by any remote, unauthenticated actor.