---
id: CVE-2026-61737
title: >-
  ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in
  ng-antd-admin
summary: >-
  ng-antd-admin is an Angular and NestJS administration system template. Prior
  to 22.0, a hardcoded default `JWT` secret permits token forgery when a
  deployment has not replaced the default secret, without a startup warning. An
  attacker ca…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-321
vendor: huajian123
product: ng-antd-admin
affected:
  - ng-antd-admin < 22.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-30T15:48:43.650655Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:51:24.314Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61737'
references:
  - url: >-
      https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h
    label: >-
      https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h
  - url: >-
      https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9
    label: >-
      https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9
  - url: 'https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0'
    label: 'https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0'
tags:
  - cve.org
epss: 0.00507
epssPercentile: 0.43411
ingestedAt: '2026-11-05T16:07:30.501Z'
---

## Overview

ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.

## Affected

- `ng-antd-admin < 22.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.