Vulnerability Description
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b
- https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0
- https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-w
FAQ
What is CVE-2026-61737?
CVE-2026-61737 is a vulnerability with a CVSS score of 9.8 (CRITICAL). ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, with...
How severe is CVE-2026-61737?
CVE-2026-61737 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-61737?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.