https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-29T18:03:10.764349+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-117564 CVE-2026-117564 — nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret 2026-10-29T18:03:10.765832+00:00

Affected: buqiyuan nest-admin

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.