CVE-2026-117564: nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWTSECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of nest-admin before version 1.0.1 are affected if they rely on the hardcoded JWT secret present in .env.production. The issue enables remote exploitation without authentication or user interaction.
What does an attacker need to exploit this issue?
An attacker needs the known hardcoded JWT secret and the ability to submit a forged JWT to the application. They can create tokens that JwtStrategy and RbacGuard accept, including tokens impersonating arbitrary user IDs or asserting the admin role.
What access can a successful attacker obtain?
A successful attacker can obtain full administrative access by forging a token with an administrator role. The reported impact includes complete compromise of confidentiality, integrity, and availability.
How can teams determine whether they may be affected?
Check whether the deployment uses a nest-admin version earlier than 1.0.1 and whether its JWT_SECRET originates from the .env.production value containing the committed hardcoded secret. Also review authentication logs for JWTs claiming unexpected user IDs or administrator roles.