CVE-2026-61737 Details
Description
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
A vulnerability exists in ng-antd-admin, an Angular and NestJS administration template, prior to version 22.0, due to a hardcoded default JWT secret. If the default secret is not replaced before deployment, the application allows token forgery without any startup warning. This flaw enables attackers to bypass authentication and authorization, impersonate any user (including administrators), and access protected API endpoints. The consequences include account takeover, data leakage, and unauthorized operations.
Users can upgrade to ng-antd-admin version 22.0 or later, where this vulnerability has been patched. In version 22.0, the hardcoded JWT secret has been removed, and users are required to provide a custom secret via environment variables. For those unable to upgrade, it is recommended to manually change the JWT secret in the configuration file or environment variables to a strong, randomly generated string.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9 | [email protected] | Source CodeVendor |
| https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0 | [email protected] | Release NotesVendor |
| https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| huajian123 ng-antd-admin | < 22.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |