Critical severity · published Oct 27, 2026
CVE-2026-117564
nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret
New
9.8
CVSS
–
EPSS
No
On KEV
Description
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
nest-admin · buqiyuan
before 1.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117564
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117564
github.com
https://github.com/buqiyuan/nest-admin
github.com
https://github.com/buqiyuan/nest-admin/blob/2eeccc4cb699d1aedbe04b4437a9d095cde02c74/.env.production#L5
github.com
https://github.com/buqiyuan/nest-admin/commit/f2cec8cb776cbf113115b33164dac69a46d24097
github.com
https://github.com/buqiyuan/nest-admin/issues/92
github.com
https://github.com/buqiyuan/nest-admin/issues/93
www.vulncheck.com
https://www.vulncheck.com/advisories/nest-admin-before-1.0.1-authentication-bypass-via-hardcoded-jwt-secret