According to VulnCheck's advisory, a critical authentication bypass in buqiyuan's nest-admin before 1.0.1 lets unauthenticated attackers sign their own administrator tokens using a hardcoded JWT secret committed to the project's repository.
What Is It
CVE-2026-117564 is an authentication bypass in nest-admin, a project maintained by buqiyuan. VulnCheck disclosed it, and it was published to NVD on 2026-10-27. Versions before 1.0.1 ship a hardcoded JWT_SECRET in the committed .env.production file. Because the secret is public, attackers can sign their own JSON Web Tokens with it. The advisory states that nest-admin's JwtStrategy and RbacGuard components then accept those tokens as valid.
VulnCheck's advisory says a forged token lets an attacker pose as any user ID or claim the admin role, which would give them full administrative access. In practice, this applies to deployments that kept the committed default secret. Instances that replaced JWT_SECRET with their own value would not accept tokens signed with the public one. The weakness is classified as CWE-321 (Use of Hard-coded Cryptographic Key).
Why It Matters
- Severity: CVSS 3.1 base score of 9.8 (CRITICAL), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 score is 9.3 (CRITICAL). - Low barrier to exploit: The attack works over the network, has low complexity, and needs no privileges or user interaction.
- Full impact: Confidentiality, integrity, and availability impacts are all rated High.
- Public key material: The signing secret sits in the project's public GitHub repository, so anyone who can read the repo can obtain it.
Exploitation status: No CISA KEV entry was supplied for this CVE, so KEV does not confirm active exploitation. The NVD record marks exploit maturity as "Not Defined." Its NVD analysis status is "Deferred."
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| buqiyuan | nest-admin | All versions before 1.0.1 (semver) |
The NVD record lists no CPEs. The affected range comes from the CNA-supplied version data, which treats versions from 0 up to but not including 1.0.1 as affected.
Patch Status
The CNA's affected-version data lists 1.0.1 as the first version that is not affected. Organizations running nest-admin should upgrade to 1.0.1 or later. The NVD references include a fix-related commit (f2cec8c) and two GitHub issues (#92, #93) in the project repository. No CISA KEV required action or due date applies, because no KEV entry exists for this CVE.