---
id: "CVE-2026-117564"
kind: "vulnerability"
aliases: ["CVE-2026-117564"]
title: "nest-admin: hardcoded JWT secret lets attackers forge admin tokens"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nest-admin", "nestjs", "node", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-27T14:16:38+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:32:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117564", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# nest-admin: hardcoded JWT secret lets attackers forge admin tokens

nest-admin before 1.0.1 ships a JWT_SECRET committed in .env.production, and its JwtStrategy and RbacGuard trust tokens signed with it. An unauthenticated attacker who knows that secret can sign tokens for any user ID or the admin role and gain full administrative access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for a committed `.env.production` in the repository and check whether it contains `JWT_SECRET`
- Check the installed version with `npm ls nest-admin`; anything below `1.0.1` is affected
- Confirm whether the running deployment loads its JWT secret from `.env.production` rather than an environment variable or secret store

## Fix

- Upgrade nest-admin to `1.0.1` or later
- Rotate JWT_SECRET in every environment that used the committed value and invalidate existing tokens
- Remove `.env.production` from version control and add it to `.gitignore`

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117564

## From the sources

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_