ng-antd-admin Hardcoded JWT Secret Allows Authentication Bypass

ng-antd-admin, an Angular and NestJS administration system template, contains a hardcoded default JWT secret vulnerability. Prior to version 22.0, deployments that do not replace the default secret receive no startup warning, allowing attackers to forge valid tokens.

An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints. This can lead to account takeover, data leakage, and unauthorized operations.

Affected versions and fix:

• Versions prior to 22.0 are vulnerable if the default secret is not replaced.
• Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.