{"id":"CVE-2026-61737","published":"2026-10-30T15:16:53.363","lastModified":"2026-10-30T19:39:14.897","description":"ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9","tags":[]},{"url":"https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0","tags":[]},{"url":"https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h","tags":[]}],"exploitRefs":[{"url":"https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9","tags":[]},{"url":"https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0","tags":[]},{"url":"https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h","tags":[]}],"hasPoc":true,"ai":{"summary":"A hardcoded JWT secret in ng-antd-admin prior to v22.0 allows attackers to forge authentication tokens, bypassing login and impersonating any user including admins, leading to full system compromise.","exploitability":"Trivial to exploit if the default JWT secret is unchanged; no authentication or user interaction required.","blast_radius":"Complete account takeover, data exfiltration, and unauthorized administrative actions across all affected deployments using the default secret.","remediation":"Upgrade to ng-antd-admin v22.0 or later, which rejects the default secret in production and warns in non-production environments.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["jwt-forgery","auth-bypass","hardcoded-secret","token-abuse"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:46:44.461Z"}}