Live › vulnerability › CVE-2026-61737
ng-antd-admin is an Angular and NestJS admin template that ships with a hardcoded default JWT signing secret. An attacker who knows that default can forge tokens and log in as any user, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams running ng-antd-admin before 22.0 that never replaced the default JWT secret. Version 22.0 refuses the shipped secret in production but still accepts it with only a warning in non-production environments, so staging or test servers reachable from the internet remain exposed. Deployments with a custom secret are not affected by the token forgery.
No product ranges from the sources yet.
JWT secret in its environment or config file, not a custom value22.0 are affected22.0 or later, which rejects the shipped secret in productionJWT secret with your own value in every environmentEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default JWT secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
This page as .md · .json · in your agent: get_signal("CVE-2026-61737")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.