Description

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-10-11T13:17:20.237Z",
  "pubdate": "2026-10-11T13:17:20.237Z",
  "executiveSummary": "A critical security vulnerability has been identified in Agnaistic agnai through version 1.0.555, stemming from hard-coded credentials and cryptographic keys embedded within its deployment configuration. Specifically, the template file self-host.docker-compose.yml configures a static administrative password as well as a publicly exposed JSON Web Token (JWT) signing secret key.\nThis vulnerability allows remote, unauthenticated attackers to completely compromise the target application without needing initial access or existing credentials. Threat actors can exploit this weakness either by authenticating directly with the known default administrative password or by forging custom JWTs signed with the public secret and carrying administrative privileges.\nSuccessful exploitation grants full administrative control over the affected Agnaistic agnai instance. Attackers can leverage this access to impersonate arbitrary application users, perform unauthorized password resets, and modify sensitive server configurations. Self-hosted instances deployed using the standard configuration file face high risk and immediate threat of compromise.",
  "technicalDetails": "The primary root cause of this vulnerability lies in insecure static configuration practices within Agnaistic agnai through version 1.0.555. The self-hosting orchestrator file self-host.docker-compose.yml provides predefined parameters for initial setup. However, it ships with fixed administrative login credentials and a default, publicly readable JWT secret key rather than forcing dynamic generation or runtime environment variable injection.\nBecause the JWT signing secret is static and publicly documented within self-host.docker-compose.yml, the cryptographic integrity of authentication tokens generated by or presented to the application is completely nullified. In a standard JWT implementation, the server relies on the confidentiality of the secret key to verify that incoming tokens were issued by a trusted authority and that claims have not been altered. With the secret key exposed, any external party can act as an authority.\nAn unauthenticated attacker can execute exploitation through two primary attack vectors across the network:\n1. Administrative Password Reuse: The attacker navigates to the application authentication interface and submits the fixed default administrator password defined in self-host.docker-compose.yml, instantly obtaining an authenticated administrative session.\n2. Arbitrary JWT Token Forgery: The attacker constructs a local JWT payload containing custom authorization claims, specifically setting the privilege flag to admin: true. Using the publicly known JWT secret from self-host.docker-compose.yml, the attacker calculates a valid cryptographic signature for the token. When transmitted in HTTP requests to the server, the application validates the signature against its identical local secret, accepting the forged token as legitimate and granting full administrative access.\nPost-exploitation capabilities are extensive. Once administrative access is established, the attacker can interact with administrative endpoints to impersonate any registered user context, execute forced password resets against target accounts, and manipulate global server configuration settings. The attack requires no privileges, no user interaction, and can be completely automated."
}