CVE-2026-61737Critical 9.8
ng-antd-admin: Authentication bypass via hardcoded default JWT secret
ng-antd-admin, an Angular and NestJS administration template, ships with a hardcoded default JWT secret. If a deployment does not replace this secret, an attacker can forge valid tokens, including administrator tokens, without any account. This allows bypassing authentication and authorization, accessing protected API endpoints, and taking over accounts, which can lead to data leakage and unauthorized changes. Version 22.0 rejects the default secret in production but still accepts it with a warning in non-production environments.
huajian123 · ng-antd-admin