CVE-2026-0622: Hardcoded Secret Exposes Open5GS 5G Core Networks

A critical vulnerability (CVE-2026-0622) was discovered in the Open5GS WebUI: the application shipped with hardcoded default JWT signing secrets set to a known value ('change-me'), allowing anyone to forge valid admin tokens and gain full administrative access to the WebUI, exposing subscriber data and system configuration. A patch was released in v2.7.6 (July 2025) that removes the hardcoded defaults and introduces a self-contained .env for secrets; administrators should immediately set strong, random values for process.env.SECRET_KEY and process.env.JWT_SECRET_KEY if they cannot patch immediately.