Description
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
Published: 2026-10-30
Score: 9.8 Critical
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
Title ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin
Weaknesses CWE-321
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-30T15:51:24.314Z

Reserved: 2026-07-10T18:59:00.047Z

Link: CVE-2026-61737

cve-icon Vulnrichment

Updated: 2026-10-30T15:48:46.483Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T15:16:53.363

Modified: 2026-10-30T19:39:14.897

Link: CVE-2026-61737

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T16:00:16Z

Weaknesses
  • CWE-321

    Use of Hard-coded Cryptographic Key