Vulnerability Description
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/buqiyuan/nest-admin
- https://github.com/buqiyuan/nest-admin/blob/2eeccc4cb699d1aedbe04b4437a9d095cde0
- https://github.com/buqiyuan/nest-admin/commit/f2cec8cb776cbf113115b33164dac69a46
- https://github.com/buqiyuan/nest-admin/issues/92
- https://github.com/buqiyuan/nest-admin/issues/93
- https://www.vulncheck.com/advisories/nest-admin-before-1.0.1-authentication-bypa
FAQ
What is CVE-2026-117564?
CVE-2026-117564 is a vulnerability with a CVSS score of 9.8 (CRITICAL). nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production...
How severe is CVE-2026-117564?
CVE-2026-117564 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-117564?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.