CVE-2026-117564 Details

A vulnerability allowing authentication bypass has been identified in nest-admin versions prior to 1.0.1. This issue arises from a hardcoded JWT secret in the production environment file, which is publicly accessible. Unauthenticated attackers can exploit this by forging administrator tokens, as the secret is used to sign tokens that are trusted by the application's authentication and role-based access control mechanisms. This allows attackers to impersonate any user or claim administrative roles, granting full access to the application.

Users are advised to update to nest-admin version 1.0.1 or later, and to rotate their JWT secrets and refresh token secrets before deploying the updated version.