Live › vulnerability › CVE-2026-117564
Go to dashboardnest-admin before 1.0.1 ships a JWT_SECRET committed in .env.production, and its JwtStrategy and RbacGuard trust tokens signed with it. An unauthenticated attacker who knows that secret can sign tokens for any user ID or the admin role and gain full administrative access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams running nest-admin before 1.0.1 where the deployed build uses the JWT_SECRET from the committed .env.production file. Any reachable instance that accepts those JWTs for authorization is exposed to forged admin tokens. Deployments that already upgraded or that load a secret from their own secret store rather than the committed file can skip it.
No product ranges from the sources yet.
.env.production in the repository and check whether it contains JWT_SECRETnpm ls nest-admin; anything below 1.0.1 is affected.env.production rather than an environment variable or secret store1.0.1 or later.env.production from version control and add it to .gitignoreEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.
This page as .md · .json · in your agent: get_signal("CVE-2026-117564")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.