nest-admin: Authentication bypass via hardcoded JWT secret

Summary

nest-admin, an open-source NestJS admin backend, ships with a fixed JWT signing secret committed in its .env.production file. An unauthenticated remote attacker who knows this public secret can forge administrator tokens, impersonate any user ID or claim the admin role, and gain full administrative access. Exploitation requires only that a vulnerable instance is reachable and still uses the committed secret.

Affected

• nest-admin versions before 1.0.1
• Instances deployed from the repository env files or with the committed JWT_SECRET and REFRESH_TOKEN_SECRET values
• VulDB lists versions up to 1.0.0; the full version history has not been verified.

Fixed in

• Version 1.0.1 (commit f2cec8cb776cbf113115b33164dac69a46d24097)
• Committed secrets removed; the server refuses to start with missing, short (under 32 characters) or placeholder secrets
• Roles are loaded from the database; only server-issued access tokens are accepted

Workaround

• No vendor workaround documented.
• Restrict access to the nest-admin interface with network segmentation or IP allow-lists so it is not reachable from the internet. This does not remove the flaw for internal users.

Exploitation

• Not known to be exploited in the wild.
• VulDB reports no public exploit, but the secret is public in the repository, so exploitation is trivial once an instance is found.
• CISA SSVC: automatable yes, technical impact total.

Our recommendation

• Inventory all nest-admin instances, including Docker images and forks, and check their versions.
• Upgrade to 1.0.1 or later and set new random JWT_SECRET and REFRESH_TOKEN_SECRET values of at least 32 characters.
• Treat tokens signed with the old secret as compromised: review admin-account activity and logs.
• Remove internet exposure of admin panels until the upgrade is verified.
• Check forks or copies for committed env files and revoke any SMTP or other credentials stored there.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• nest-admin v1.0.1 release github.com
• Fix commit f2cec8cb github.com
• Committed .env.production at 2eeccc4 github.com
• nest-admin issue #92 github.com
• VulnCheck advisory www.vulncheck.com
• VulDB entry 427201 vuldb.com
• Offseq threat summary radar.offseq.com
• NVD-derived record (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:36.