Vulnerability details

CVE-2026-61737

huajian123 ng-antd-admin

ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin

CVSS 3.1

9.8Critical

Official description

ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
huajian123	ng-antd-admin	< 22.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h x_refsource_CONFIRM
https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9 x_refsource_MISC
https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-30
Last updated: 2026-10-30
State: Published
Assigner (CNA): GitHub_M
Kolun priority: 26 · Low

Exploit prediction (EPSS)

0.5%

Probability of exploitation in 30 days

43.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-321
Use of Hard-coded Cryptographic Key