---
id: "CVE-2026-61737"
kind: "vulnerability"
aliases: ["CVE-2026-61737"]
title: "ng-antd-admin: hardcoded default JWT secret lets attackers forge admin tokens"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["angular", "nestjs", "ng-antd-admin", "other", "self-hosted"]
not_affected_if: ["custom-jwt-secret", "version-22-or-later-in-production"]
published_at: "2026-10-30T15:16:53+00:00"
first_seen_at: "2026-10-30T15:31:11+00:00"
updated_at: "2026-10-30T15:33:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61737", "first_seen_at": "2026-10-30T15:31:11+00:00"}]
---

# ng-antd-admin: hardcoded default JWT secret lets attackers forge admin tokens

ng-antd-admin is an Angular and NestJS admin template that ships with a hardcoded default JWT signing secret. An attacker who knows that default can forge tokens and log in as any user, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment still uses the shipped default `JWT` secret in its environment or config file, not a custom value
- Check the installed version of ng-antd-admin; versions before `22.0` are affected

## Fix

- Upgrade ng-antd-admin to `22.0` or later, which rejects the shipped secret in production
- Replace the default `JWT` secret with your own value in every environment

## Timeline

- 2026-10-30T15:31:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61737

## From the sources

ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_