SZB-dbee47259b
EUVD-2026-114000 reports hardcoded JWT secret in ng-antd-admin
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- huajian123
- Product
- ng-antd-admin
- First seen
Summary
The EUVD advisory states that prior to version 22.0, ng-antd-admin uses a hardcoded default JWT secret, which permits token forgery when deployments do not replace it, and no startup warning is shown. The item is truncated, but the advisory says an attacker can bypass authentication.
If you use huajian123
Upgrade ng-antd-admin to version 22.0 or later
Replace any default JWT secret with a strong, unique value now
Invalidate existing tokens and review admin accounts for misuse
What the sources say 1
· Mastodon: “Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning.” Source