Filtered by vendor Buqiyuan Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-117564 1 Buqiyuan 1 Nest-admin 2026-10-29 9.8 Critical
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.