H3-2026-1134¶
DbGate Hardcoded Static JWT Secret Permission Bypass
| Category | CREDENTIALS |
| Base Score | 9.8 |
Description¶
DbGate exposes an executeQuery endpoint that accepts a useToken JSON Web Token verified against a static secret value that is hardcoded into the published source code. Remote attackers who read the public repository can derive the same secret and mint a token containing a matching content hash. The forged token satisfies the role permission checks guarding both the dbops query and run script capabilities. Because the signing secret never varies between deployments, every installation running the vulnerable code shares the identical bypass. The flaw stems from a static token secret rather than a per process or per installation derived value.
Impact¶
Remote attackers gain the ability to execute arbitrary SQL statements against any database connection configured in DbGate. This exposes stored credentials, customer data, and internal records across every connected system. Attackers can modify or delete records without a legitimate session. Any organization exposing a DbGate instance to untrusted networks faces broad data compromise.