Nest Admin
Monthly
Unauthenticated attackers can forge valid administrator JSON Web Tokens against nest-admin before 1.0.1 because the JWT signing secret (and the refresh-token secret) is committed to the repository as the fixed placeholder value 'admin!@#123'. Any deployment still running with the shipped .env.production or .env.development secret is fully compromised: an attacker signs a token asserting any user ID or the admin role, and JwtStrategy and RbacGuard accept it without further checks, yielding complete confidentiality, integrity and availability impact (CVSS 4.0 base 9.3, assessed CVSS 3.1 9.3, CWE-321). No public exploit code has been identified at time of analysis, although the key material itself is publicly readable in the project's Git history; VulnCheck assigns an 'act_now' priority, and the sole limiting factor is whether an operator replaced the committed secret with an independent strong value. The vendor fixed the issue in 1.0.1 and states that any environment that ever ran with the historical default must rotate both secrets and reissue all sessions after upgrading.
Unauthenticated attackers can forge valid administrator JSON Web Tokens against nest-admin before 1.0.1 because the JWT signing secret (and the refresh-token secret) is committed to the repository as the fixed placeholder value 'admin!@#123'. Any deployment still running with the shipped .env.production or .env.development secret is fully compromised: an attacker signs a token asserting any user ID or the admin role, and JwtStrategy and RbacGuard accept it without further checks, yielding complete confidentiality, integrity and availability impact (CVSS 4.0 base 9.3, assessed CVSS 3.1 9.3, CWE-321). No public exploit code has been identified at time of analysis, although the key material itself is publicly readable in the project's Git history; VulnCheck assigns an 'act_now' priority, and the sole limiting factor is whether an operator replaced the committed secret with an independent strong value. The vendor fixed the issue in 1.0.1 and states that any environment that ever ran with the historical default must rotate both secrets and reissue all sessions after upgrading.