ng-antd-admin: Authentication bypass via hardcoded default JWT secret
Summary
ng-antd-admin, an Angular and NestJS administration template, ships with a hardcoded default JWT secret. If a deployment does not replace this secret, an attacker can forge valid tokens, including administrator tokens, without any account. This allows bypassing authentication and authorization, accessing protected API endpoints, and taking over accounts, which can lead to data leakage and unauthorized changes. Version 22.0 rejects the default secret in production but still accepts it with a warning in non-production environments.
Affected
- ng-antd-admin versions before 22.0
- Earliest affected version: Unknown.
Fixed in
- Fixed in version 22.0 (release tag v22.0, commit 23e92ff).
- Later point releases: Unknown.
Workaround
- Replace the default JWT secret with a strong, unique value before deployment, including test and staging systems.
- Restrict access to the admin API until the secret is replaced.
Exploitation
- Not known to be exploited in the wild (as of 30 Oct 2026).
- Public proof of concept: Unknown.
- CVSS 3.1 base score 9.8 (Critical), network attack, no privileges or user interaction required (scored by the CNA GitHub; NVD status: Received).
Our recommendation
- Inventory all ng-antd-admin deployments, including forks, staging and test systems.
- Upgrade to version 22.0 or later and confirm that no instance uses the shipped default secret, including non-production instances.
- Rotate the JWT secret and invalidate existing sessions, since tokens may have been forged before the fix.
- Review administrator activity for the period when the default secret was in use.
- Restrict internet exposure of admin interfaces and monitor the advisory for updates.
Research sources
- GitHub Security Advisory GHSA-qphq-m2hv-wj5h github.com
- Fix commit 23e92ff github.com
- Release v22.0 github.com
- OffSeq threat radar entry CVE-2026-61737 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:21.
Original description (NVD)
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.