CVE-2026-117564
Critical
Description
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.
SeverityCritical
CVSS9.8
Exploit probability—
ProductBuqiyuan Nest-admin
PublishedOct 27, 2026
First seenOct 27, 2026
Weakness typeCWE-321CWE-321
How to fix
Update
- buqiyuan nest-admin1.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| buqiyuan nest-admin | v < 1.0.1 | 1.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.