CVE-2026-0622: Hardcoded Secret Exposes Open5GS 5G Core Networks

CVE-2026-0622 has been identified in Open5GS, a widely used open-source implementation of 5G core network functions, with attackers able to forge administrative tokens and take control of the WebUI through default hardcoded secrets. The flaw targets the optional WebUI component and centres on how authentication uses JSON Web Tokens, where critical environment variables were initialised to a static value: “change-me”, allowing any holder of the token to sign their own credentials.

According to CERT vulnerability note, the Open5GS WebUI contains default hardcoded secrets used for security-sensitive operations, including JWT signing, which enables an attacker to forge valid tokens and gain administrative access if the defaults are not changed.

A patch was released against version v2.7.6 in July 2025 to replace the hardcoded values with a self-contained .env file for the WebUI’s Next.js environment, but administrators may still need to apply manual configuration to define strong random values for process.env.SECRET_KEY and process.env.JWT_SECRET_KEY. The vulnerability was reported by Andrew Fasano from NIST’s Center for AI Standards & Innovation, and exploitation could result in full access to the WebUI and its data.