{"id":"CVE-2026-117564","published":"2026-10-27T14:16:38.720","lastModified":"2026-10-27T16:04:22.707","description":"nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/buqiyuan/nest-admin","tags":[]},{"url":"https://github.com/buqiyuan/nest-admin/blob/2eeccc4cb699d1aedbe04b4437a9d095cde02c74/.env.production#L5","tags":[]},{"url":"https://github.com/buqiyuan/nest-admin/commit/f2cec8cb776cbf113115b33164dac69a46d24097","tags":[]},{"url":"https://github.com/buqiyuan/nest-admin/issues/92","tags":[]},{"url":"https://github.com/buqiyuan/nest-admin/issues/93","tags":[]},{"url":"https://www.vulncheck.com/advisories/nest-admin-before-1.0.1-authentication-bypass-via-hardcoded-jwt-secret","tags":[]}],"exploitRefs":[{"url":"https://github.com/buqiyuan/nest-admin","tags":[]},{"url":"https://github.com/buqiyuan/nest-admin/blob/2eeccc4cb699d1aedbe04b4437a9d095cde02c74/.env.production#L5","tags":[]},{"url":"https://github.com/buqiyuan/nest-admin/commit/f2cec8cb776cbf113115b33164dac69a46d24097","tags":[]},{"url":"https://github.com/buqiyuan/nest-admin/issues/92","tags":[]},{"url":"https://github.com/buqiyuan/nest-admin/issues/93","tags":[]}],"hasPoc":true,"ai":{"summary":"A hardcoded JWT secret in .env.production allows unauthenticated attackers to forge valid administrator tokens, bypassing authentication entirely.","exploitability":"Trivial to exploit; requires only knowledge of the exposed secret and ability to craft a JWT signed with it.","blast_radius":"Full system compromise is possible: attackers can impersonate any user—including admins—and gain unrestricted access to all administrative functions.","remediation":"Upgrade to nest-admin version 1.0.1 or later, which removes the hardcoded secret and enforces secure secret management.","detection":"Look for JWT tokens signed with the known leaked secret in authentication headers; detect anomalous admin-role claims (e.g., role: 'admin') issued by non-admin endpoints or from IPs outside normal access patterns.","tags":["auth-bypass","jwt","hardcoded-secret","privilege-escalation","web"],"model":"garnet-coder","analyzedAt":"2026-10-28T10:00:57.496Z"}}