nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret (buqiyuan nest-admin)

CVE-2026-117564

CRITICAL 9.3

At a glance

Source: NVD
EPSS: EPSS 0.60 % · percentile 49 (2026-10-29)
State: PUBLISHED
Published: 2026-10-27 13:07 UTC
Updated: 2026-10-28 16:16 UTC
Assigner: VulnCheck
NVD status: Deferred

Search on…

Description

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.

Weaknesses (CWE)

CWE-321 — Use of Hard-coded Cryptographic Key

References

Scores

Version	Score	Vector	Scored by
CVSS 4.0	CRITICAL 9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck
CVSS 4.0	CRITICAL 9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · disclosure@vulncheck.com (Primary)

European references

ENISA EUVD · EUVD-2026-110842
GCVE · GCVE-0-2026-117564

Affected products

Product	Versions
buqiyuan · nest-admin	affected 0 < 1.0.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret (buqiyuan nest-admin)