by Kastro
Paper/Archive/CVE-2026-61737

CVE-2026-61737

huajian123 ng-antd-admin — ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin

CVSS 9.8
critical.is priorityof 100
29
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.

Affected

ProductAffectedFixed inSource
ng-antd-admin< 22.0–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5hrefgithub.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9refgithub.com/huajian123/ng-antd-admin/releases/tag/v22.0