ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin
Only ng-antd-admin deployments before 22.0 that keep the project's default JWT secret are exposed. The fix is in 22.0, and replacing the default secret with a random string is the stated workaround.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Fix
- Fixed in 22.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
ng-antd-admin, an Angular and NestJS administration system template, is affected when deployed with its default hardcoded JWT secret still in place. An attacker who knows this public default can forge authentication tokens, impersonate any user including administrators, and gain unauthorized access to protected data and operations.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- huajian123 ng-antd-admin
fixed in 22.0
References 3
GitHub · huajian123/ng-antd-admin
Questions about CVE-2026-61737
What does this mean?
The project ships with a built-in default JWT signing secret. Anyone who knows that secret can forge valid tokens, pass as any user including administrators, and reach protected API endpoints.Source: github.com
Am I affected, and how do I check?
Versions before 22.0 are affected when the default JWT secret has not been replaced. To check, look at the JWT secret setting in the configuration file or environment variables and see whether it still matches the project default.Source: github.com
What should I do about it?
Upgrade to version 22.0 or later. Until then, set the JWT secret in the configuration file or environment variables to a strong, randomly generated string.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data