{"id":"CVE-2026-105141","summary":"topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials","details":"A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI_USERS_JWT_SECRET results in hard-coded credentials. The attack may be launched remotely. Upgrading to version 1.6.0 is sufficient to fix this issue. The patch is identified as fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.","modified":"2026-10-20T11:15:09.810216676Z","published":"2026-10-04T07:45:15.985Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-259","CWE-798"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105141.json"},"references":[{"type":"WEB","url":"https://github.com/topoteretes/cognee/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105141.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105141"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-105141"},{"type":"ADVISORY","url":"https://vuldb.com/submit/944531"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/413365"},{"type":"REPORT","url":"https://linear.app/cognee/issue/SDK-720/replace-the-super-secret-fallback-for-token-signing-secrets-with-a-per"},{"type":"REPORT","url":"https://vuldb.com/vuln/413365/cti"},{"type":"FIX","url":"https://github.com/topoteretes/cognee/commit/fa65fc0cd86cdba48d19aa76e36be862be982f5d"},{"type":"FIX","url":"https://github.com/topoteretes/cognee/pull/5062"},{"type":"FIX","url":"https://github.com/topoteretes/cognee/releases/tag/v1.6.0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/topoteretes/cognee","events":[{"introduced":"0"},{"fixed":"fa65fc0cd86cdba48d19aa76e36be862be982f5d"},{"fixed":"bbec4a28b271103c291eeabb69ec873e69f44db6"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"1.5.4"}],"source":"DESCRIPTION"},{"range":[{"fixed":"fa65fc0cd86cdba48d19aa76e36be862be982f5d"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v1.6.0","range":[{"fixed":"bbec4a28b271103c291eeabb69ec873e69f44db6"}]}]}}],"versions":["1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","v1.5.4","v1.5.3.dev1","v1.5.3","v1.5.2","v1.5.1","v1.5.0.dev5","v1.5.0.dev4","v1.5.0.dev3","v1.5.0","v1.4.2","v1.4.1.dev1","v1.4.1","v1.4.0.dev4","v1.4.0.dev1","v1.4.0","v1.3.0","v1.2.2","v1.2.1","v1.2.0","v1.1.3","v1.2.0.dev1","v1.1.2","v1.1.1","v1.1.0","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1.dev4","v1.0.1","v1.0.1.dev3","v1.0.1.dev2","v1.0.1.dev0","v1.0.0","v1.0.0.dev0","v0.5.8","v0.5.5","v0.5.7.dev0","v0.5.4.dev1","v0.5.7","v0.5.6","v0.5.5.dev0","v0.5.4","v0.5.4.dev0","v0.5.3","v0.5.3.dev1","v0.5.2","v0.5.3.dev0","v0.5.2.dev0","v0.5.1","v0.5.1.dev0","v0.5.0","v0.5.0.dev1","v0.4.1","v0.5.0.dev0","v0.4.0","v0.3.9","v0.3.8","v0.3.7","v0.3.6","v0.3.5","v0.3.4.dev4","v0.3.4","v0.3.4.dev3","v0.3.4.dev2","v0.3.4.dev1","v0.3.4.dev0","v0.3.2","v0.3.3","v0.3.1","v0.3.0","v0.2.4","v0.2.3","v0.2.2","v.0.2.2","v0.2.1","v0.2.1.dev6","v0.2.1.dev1","v0.2.0","v0.2.0.dev0","v0.1.35","v0.1.34","v0.1.33","v0.1.32","v0.1.31","v0.1.30","v0.1.29","v0.1.28","v0.1.27","v0.1.26","v0.1.25","v0.1.24","v0.1.23","v0.1.22","v0.1.21","v0.1.20","v0.1.19","v0.1.18","v0.1.17","v0.1.16","v0.1.15","v0.1.14","v0.1.13","v0.1.12","v0.1.1","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v.0.1.1","v0.1.0","0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105141.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}]}