CVE-2026-61737

Name of the Vulnerable Software and Affected Versions ng-antd-admin versions prior to 22.0

Description This administration system template contains a hardcoded default JWT secret used for token signing. If the default secret is not replaced during deployment, an attacker can forge tokens to bypass authentication and authorization. This allows the attacker to impersonate any user, including administrators, and access protected API endpoints, potentially leading to account takeover, data leakage, and unauthorized operations.

Recommendations Update to version 22.0.