Authentication Bypass in Nest-Admin by Buqiyuan

CVE-2026-117564

What is CVE-2026-117564?

The Nest-Admin framework prior to version 1.0.1 is susceptible to an authentication bypass vulnerability. This issue arises from a hardcoded JWT_SECRET, which allows unauthorized attackers to forge administrator tokens. By exploiting this flaw, attackers can impersonate any user or assert administrative privileges, thereby gaining full access to the application's functionalities. This vulnerability poses a significant risk to data integrity and security, as the compromised tokens can be manipulated without any authentication. Users are strongly encouraged to update to the latest version to mitigate this risk.

References