External risk intelligence

ng-antd-admin JWT Secret Token Forgery Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-61737

The vulnerability exists in an administration system template (Angular and NestJS) that exposes API endpoints. Such systems are commonly deployed as internet-facing web applications or management portals where authentication mechanisms, such as JWT validation, are primary controls for public-facing or remote access services.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the ng-antd-admin system template, specifically impacting its authentication mechanism. A hardcoded default secret in the JSON Web Token (JWT) system, if not updated, allows attackers to forge tokens. This could enable them to impersonate any user, including administrators, leading to unauthorized access to protected data and functions.

Default secret allows anyone to impersonate users.
Affects administrative access and sensitive data.
Confirm relevance and potential exposure of systems.

Attack Path

How an attacker could exploit the issue

An attacker could compromise the ng-antd-admin system by exploiting a hardcoded JWT secret that is not replaced during deployment. This allows them to forge authentication tokens, bypass security controls, and gain unauthorized access to sensitive areas of the application. The lack of a startup warning exacerbates this risk, potentially leading to account takeover, data breaches, and the execution of unauthorized actions by impersonating any user, including administrators.

Publicly accessible API endpoints are required.
Forging JWT tokens with a default secret.
Full account takeover and data compromise.

Live Threat

Current exploitation, exposure, and threat context

A hardcoded default JWT secret in ng-antd-admin can allow an attacker to forge authentication tokens. When this default secret is not replaced and no startup warning is present, an attacker could bypass authentication and authorization mechanisms. This could lead to unauthorized access to protected API endpoints and impersonation of any user, including administrators.

User and administrator accounts at risk.
Token forgery via default secret.
Account takeover and data leakage.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners are likely responsible for ng-antd-admin deployments, as this administration system template facilitates access to protected API endpoints. The first practical step is to identify all instances of this technology, confirm their reachability and business criticality, identify the accountable owner, and then plan remediation based on the assessed risk.

Confirm application ownership and deployment scope.
Verify if default JWT secret is in use.
Plan remediation based on business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ng-antd-admin?

It is a pre-built software template using Angular and NestJS. Developers use it to quickly set up administration panels for web applications, providing ready-made structures for managing users, data, and protected API endpoints.

What does CWE-321 mean for CVE-2026-61737?

CWE-321 refers to the use of a hard-coded cryptographic key. In this case, the system ships with a default secret key for generating security tokens. Because this key is known, it allows attackers to bypass login screens and impersonate legitimate users.

How can an attacker trigger this vulnerability?

An attacker can forge a valid authentication token using the known default secret key. The bug is only triggered if the default key has not been changed; it is not triggered if the administrator has already updated the configuration to a unique, private value.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal notes that because ng-antd-admin is an administration portal with API endpoints, it is frequently placed on the internet. If your instance is internet-facing or accessible remotely, it is highly likely to be reachable by unauthorized parties.

What should I do if I use ng-antd-admin?

Immediately verify if your deployment is still using the default JWT secret. If it is, update the secret to a unique, strong value immediately. You should also audit your user logs for any suspicious activity or unauthorized account access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.