ng-antd-admin CVE-2026-61737

Exploitation requires that the deployment still uses the shipped default JWT secret ('EIpWsyfiy@R@X#qn17!StJNdZK1fFF8iV6ffN!goZkqt#JxO') - i.e. the operator never overrode the SECRET value via configuration file or environment variable. In vulnerable versions (<22.0) this default is active silently with no startup warning, so affected installs are those left in out-of-the-box state. The primary limiting factor is this configuration dependency: any deployment that set a strong, custom SECRET is not exploitable through this flaw. A secondary factor is that the fix in 22.0 blacklists the known weak secret - rejecting it in production (NODE_ENV=production) and only warning in non-production - so an upgraded production instance cannot run with the default at all.

Multiple signals converge on high real-world risk for deployments still running the shipped default secret. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remote, unauthenticated, low-complexity flaw with full confidentiality, integrity and availability impact, and the vuln.today Decision label is act_now. No EPSS score and no KEV status were supplied, so there is no quantitative exploitation-probability or confirmed in-the-wild signal to weigh - this is a data gap, not evidence of low risk. No working exploit reference was provided; however, the fix commit (23e92ff) publicly discloses the exact hardcoded secret string 'EIpWsyfiy@R@X#qn17!StJNdZK1fFF8iV6ffN!goZkqt#JxO', which makes token forgery trivial for any unpatched deployment that never overrode it. The critical caveat is that this is NOT a blanket 9.8: exploitation depends entirely on whether the operator replaced the default secret. A deployment that already set a strong SECRET env value is not exploitable via this path, so the effective risk is bimodal - critical for default-secret installs, negligible otherwise. Given ng-antd-admin is a niche open-source template rather than ubiquitous infrastructure, the act_now label should be read as 'urgent for affected installs' rather than 'internet-wide emergency'.

An attacker reads the publicly disclosed default JWT secret from the project's source or fix commit, then signs a forged JWT claiming an administrator identity and submits it to the NestJS API. Because the backend validates tokens against the unchanged default secret, the forged token is accepted and the attacker gains full administrative access without any credentials. No working exploit tool was published, but forgery is trivial with any standard JWT library given the known secret.