{"id":"CVE-2026-61737","kind":"vulnerability","aliases":["CVE-2026-61737"],"related":[],"title":"ng-antd-admin: hardcoded default JWT secret lets attackers forge admin tokens","description":"ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.","summary":"ng-antd-admin is an Angular and NestJS admin template that ships with a hardcoded default JWT signing secret. An attacker who knows that default can forge tokens and log in as any user, including administrators.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["angular","nestjs","ng-antd-admin","other","self-hosted"],"not_affected_if":["custom-jwt-secret","version-22-or-later-in-production"],"how_to_check":"- Check whether the deployment still uses the shipped default `JWT` secret in its environment or config file, not a custom value\n- Check the installed version of ng-antd-admin; versions before `22.0` are affected","fix":"- Upgrade ng-antd-admin to `22.0` or later, which rejects the shipped secret in production\n- Replace the default `JWT` secret with your own value in every environment","status":"open","published_at":"2026-10-30T15:16:53+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:33:00+00:00","updated_at":"2026-10-30T15:33:00+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-30T15:33:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ng-antd-admin to `22.0` or later, which rejects the shipped secret in production\n- Replace the default `JWT` secret with your own value in every environment","reach":"internet","title":"ng-antd-admin: hardcoded default JWT secret lets attackers forge admin tokens","impact":"high","summary":"ng-antd-admin is an Angular and NestJS admin template that ships with a hardcoded default JWT signing secret. An attacker who knows that default can forge tokens and log in as any user, including administrators.","audience":"businesses","category":"other","nicknames":[],"who_cares":["angular","nestjs","ng-antd-admin","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker forges admin tokens, reads data and performs unauthorized operations","analyst_note":"Confirm the affected version range and whether any non-default setting changes exposure, using https://nvd.nist.gov/vuln/detail/CVE-2026-61737 and the project's release notes.","how_to_check":"- Check whether the deployment still uses the shipped default `JWT` secret in its environment or config file, not a custom value\n- Check the installed version of ng-antd-admin; versions before `22.0` are affected","plain_action":"","needs_analyst":true,"not_affected_if":["custom-jwt-secret","version-22-or-later-in-production"],"who_is_affected":"Teams running ng-antd-admin before 22.0 that never replaced the default JWT secret. Version 22.0 refuses the shipped secret in production but still accepts it with only a warning in non-production environments, so staging or test servers reachable from the internet remain exposed. Deployments with a custom secret are not affected by the token forgery.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000739,"input_tokens":4175,"output_tokens":642,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-61737':16A,19A '22.0':81C,130C 'access':116C 'account':122C 'admin':4A,12A,25B,33B,39B,70C 'administr':66B,76C,114C 'angular':20B,36B,73C 'antd':3A,24B,32B,69C 'api':118C 'attack':10A,51B,104C 'authent':107C 'author':109C 'bypass':106C 'cve':14A,17A 'data':124C 'default':6A,46B,55B,84C,97C 'deploy':92C 'endpoint':119C 'environ':147C 'forg':11A,57B 'forgeri':89C 'hardcod':5A,45B,83C 'host':29B 'imperson':110C 'includ':65B,113C 'jwt':7A,47B,85C 'know':53B 'lead':120C 'leakag':125C 'let':9A 'log':60B 'nestj':21B,38B,75C 'ng':2A,23B,31B,68C 'ng-antd-admin':1A,22B,30B,67C 'non':145C 'non-product':144C 'oper':128C 'permit':87C,138C 'prior':79C 'product':136C,146C 'protect':117C 'reject':131C 'replac':95C 'secret':8A,49B,86C,98C,134C 'self':28B 'self-host':27B 'ship':42B,133C 'sign':48B 'startup':101C 'system':77C 'takeov':123C 'templat':40B,78C 'token':13A,58B,88C 'unauthor':127C 'user':64B,112C 'version':129C 'warn':102C,142C 'without':99C","nicknames":[],"mitigations":[],"who_affected":"Teams running ng-antd-admin before 22.0 that never replaced the default JWT secret. Version 22.0 refuses the shipped secret in production but still accepts it with only a warning in non-production environments, so staging or test servers reachable from the internet remain exposed. Deployments with a custom secret are not affected by the token forgery.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61737","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61737","severity":null,"published_at":"2026-10-30T15:16:53+00:00","modified_at":"2026-10-30T15:16:53+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}