nest-admin versions prior to 1.0.1 contain hardcoded JWT_SECRET values that are checked by JwtStrategy and RbacGuard. An attacker who obtains the known secret can forge a JSON Web Token and supply it to protected endpoints. Because the token can carry any user ID and the admin role, the attacker can emulate a legitimate administrator and execute any privileged operation, compromising confidentiality, integrity, and availability of the management system.

The vulnerability is present in the nest-admin application released by buqiyuan. Affected versions are those earlier than 1.0.1; specific version ranges are not provided in the data. The issue is caused by a hardcoded secret in the .env.production file committed to the source repository.

With a CVSS score of 9.3 the risk is classified as Critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the exploit requires only knowledge of a publicly exposed secret, which is present in the source code. Attackers can accomplish the bypass remotely or locally by crafting a signed token and sending it to the application, which will accept it as a valid administrator session. The vulnerability can be fully exploited without any additional configuration or privileged access to the system.