Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for ng-antd-admin by huajian123

    CVE-2026-61737 (GCVE-0-2026-61737)

    Vulnerability from nvd – Published: 2026-10-30 14:34 – Updated: 2026-10-30 15:51
    VLAI
    Title
    ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin
    Summary
    ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 15:48 UTC
    CWE
    • CWE-321 - Use of Hard-coded Cryptographic Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8116 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61737",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:48:43.650655Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:51:24.314Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ng-antd-admin",
          "vendor": "huajian123",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321: Use of Hard-coded Cryptographic Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T14:34:03.817Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h"
        },
        {
          "name": "https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9"
        },
        {
          "name": "https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-qphq-m2hv-wj5h",
        "discovery": "UNKNOWN"
      },
      "title": "ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61737",
    "datePublished": "2026-10-30T14:34:03.817Z",
    "dateReserved": "2026-07-10T18:59:00.047Z",
    "dateUpdated": "2026-10-30T15:51:24.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-61737 (GCVE-0-2026-61737)

    Vulnerability from cvelistv5 – Published: 2026-10-30 14:34 – Updated: 2026-10-30 15:51
    VLAI
    Title
    ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin
    Summary
    ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 15:48 UTC
    CWE
    • CWE-321 - Use of Hard-coded Cryptographic Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8116 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61737",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:48:43.650655Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:51:24.314Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ng-antd-admin",
          "vendor": "huajian123",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321: Use of Hard-coded Cryptographic Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T14:34:03.817Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h"
        },
        {
          "name": "https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9"
        },
        {
          "name": "https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-qphq-m2hv-wj5h",
        "discovery": "UNKNOWN"
      },
      "title": "ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61737",
    "datePublished": "2026-10-30T14:34:03.817Z",
    "dateReserved": "2026-07-10T18:59:00.047Z",
    "dateUpdated": "2026-10-30T15:51:24.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}