Executive brief
Outstatic CMS, a tool used to manage and publish website content via GitHub, contains a security flaw where it uses a publicly known password to secure user sessions by default. If an administrator has not manually configured a custom secret key, an attacker can use this known password to create their own login credentials. This allows an unauthorized person to gain full administrative control over the website, potentially leading to data theft or unauthorized content changes.
Technical details
Outstatic CMS (<= 2.1.9) contains a hardcoded default value for the JWT signing secret within its source code (specifically in `packages/outstatic/src/utils/constants.ts`). The application logic falls back to this static string if the `OST_TOKEN_SECRET` environment variable is absent. Because this secret is publicly visible in the project's repository, an unauthenticated remote attacker can use it to sign forged JSON Web Tokens (JWT). By crafting a token with administrative claims, the attacker can bypass authentication and achieve full administrative access to the CMS dashboard. Users should upgrade to a version where this default is removed or ensure the `OST_TOKEN_SECRET` environment variable is set to a unique, complex value.
Affected products
- Outstatic Outstatic CMS <= 2.1.9
Timeline
- 2026-07-30: disclosed: CVE-2026-52539 published by MITRE/NVD