DataEase: authentication bypass via password-derived HMAC JWT signing key

DataEase (a Spring Boot data-visualization platform; the Chinese equivalent of Metabase / Superset) signs its authentication JWTs with an HMAC-SHA256 key derived from the admin password. In the community edition the derivation is literally MD5(SubstituleLoginConfig.getPwd()), and the password defaults to the documented constant DataEase@123456 that ships with every fresh install via dataease.default-pwd.

An unauthenticated, anonymous attacker with only network access can therefore:

1. Compute secret = MD5("DataEase@123456").
2. Forge a JWT with header {alg: HS256, typ: JWT} and payload {uid: 1, oid: 1}.
3. Present it as the X-DE-TOKEN (DataEase's auth header) and call any authenticated REST endpoint as the admin user.

This is the first link in a 4-CVE exploit chain (CVE-2026-23958 → 40899 → 40900 → 40901) that culminates in unauthenticated RCE per the OX disclosure.