Token Forgery Vulnerability in ng-antd-admin by huajian123

CVE-2026-61737

What is CVE-2026-61737?

The ng-antd-admin template, which utilizes Angular and NestJS, contains a serious vulnerability that stems from a hardcoded default JWT secret. If this default secret is not replaced by a user during deployment, it allows an attacker to forge tokens. This enables the attacker to bypass authentication and authorization mechanisms, impersonate any user including administrators, and access sensitive API endpoints. Consequently, this flaw could lead to unauthorized access, account takeovers, and potential data leaks. As of version 22.0, the framework has implemented measures to reject the default secret in production environments while issuing warnings for non-production settings.

References