CVE-2026-61737
ng-antd-admin is an Angular and NestJS administration system template
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ng-antd-admin has a hardcoded default JWT secret that can be used for token forgery, allowing an attacker to bypass authentication and authorization, impersonate users, and access protected API endpoints.
- Affected
- ng-antd-admin prior to version 22.0
- Fix
- Check the linked advisory for details, but as a general rule, replace the default JWT secret with a new one
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
Last activity 30 Oct 2026. Patch Forecast updates every hour.