{"id":"CVE-2026-117564","kind":"vulnerability","aliases":["CVE-2026-117564"],"related":[],"title":"nest-admin: hardcoded JWT secret lets attackers forge admin tokens","description":"nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.","summary":"nest-admin before 1.0.1 ships a JWT_SECRET committed in .env.production, and its JwtStrategy and RbacGuard trust tokens signed with it. An unauthenticated attacker who knows that secret can sign tokens for any user ID or the admin role and gain full administrative access.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nest-admin","nestjs","node","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Look for a committed `.env.production` in the repository and check whether it contains `JWT_SECRET`\n- Check the installed version with `npm ls nest-admin`; anything below `1.0.1` is affected\n- Confirm whether the running deployment loads its JWT secret from `.env.production` rather than an environment variable or secret store","fix":"- Upgrade nest-admin to `1.0.1` or later\n- Rotate JWT_SECRET in every environment that used the committed value and invalidate existing tokens\n- Remove `.env.production` from version control and add it to `.gitignore`","status":"open","published_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:32:44+00:00","updated_at":"2026-10-27T14:32:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T14:32:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade nest-admin to `1.0.1` or later\n- Rotate JWT_SECRET in every environment that used the committed value and invalidate existing tokens\n- Remove `.env.production` from version control and add it to `.gitignore`","reach":"internet","title":"nest-admin: hardcoded JWT secret lets attackers forge admin tokens","impact":"high","summary":"nest-admin before 1.0.1 ships a JWT_SECRET committed in .env.production, and its JwtStrategy and RbacGuard trust tokens signed with it. An unauthenticated attacker who knows that secret can sign tokens for any user ID or the admin role and gain full administrative access.","category":"package","nicknames":[],"who_cares":["nest-admin","nestjs","node","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker forges admin tokens and takes full administrative control","analyst_note":"Check the nest-admin 1.0.1 release or advisory to confirm the fixed version and whether the committed secret was the only weakness; NVD link in sources is the only reference.","how_to_check":"- Look for a committed `.env.production` in the repository and check whether it contains `JWT_SECRET`\n- Check the installed version with `npm ls nest-admin`; anything below `1.0.1` is affected\n- Confirm whether the running deployment loads its JWT secret from `.env.production` rather than an environment variable or secret store","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running nest-admin before 1.0.1 where the deployed build uses the JWT_SECRET from the committed .env.production file. Any reachable instance that accepts those JWTs for authorization is exposed to forged admin tokens. Deployments that already upgraded or that load a secret from their own secret store rather than the committed file can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000677,"input_tokens":3349,"output_tokens":684,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-117564':14A,17A '-2026':13A,16A '1.0.1':31B,76C 'access':71B,124C 'admin':3A,10A,20B,29B,65B,74C,119C 'administr':70B,88C,123C 'allow':83C 'attack':8A,51B,85C,99C 'authent':79C 'bypass':80C 'claim':117C 'commit':36B,96C 'contain':77C 'cve':12A,15A 'env.production':38B,98C 'forg':9A,87C 'full':69B,122C 'gain':68B 'hardcod':4A,93C 'host':26B 'id':62B,115C 'imperson':112C 'jwt':5A,34B,94C 'jwtstrategi':41B,108C 'know':53B 'known':105C 'let':7A 'nest':2A,19B,28B,73C 'nest-admin':1A,18B,27B,72C 'nestj':21B 'node':22B 'packag':23B 'rbacguard':43B,110C 'role':66B,120C 'secret':6A,35B,55B,95C,106C 'self':25B 'self-host':24B 'ship':32B 'sign':46B,57B,101C 'token':11A,45B,58B,89C,102C 'trust':44B,111C 'unauthent':50B,84C 'use':91C 'user':61B,114C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Teams running nest-admin before 1.0.1 where the deployed build uses the JWT_SECRET from the committed .env.production file. Any reachable instance that accepts those JWTs for authorization is exposed to forged admin tokens. Deployments that already upgraded or that load a secret from their own secret store rather than the committed file can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117564","severity":null,"published_at":"2026-10-27T14:16:38+00:00","modified_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}