CVE-2025-13877: NocoBase authentication bypass via default JWT secret

CVE-2025-13877 · Severity: medium · CVSS 5.6 · Published 2025-12-02

NocoBase is an open-source low-code database platform deployed via Docker containers. Docker deployments shipped with a publicly known default JWT (authentication token) secret, allowing attackers to forge valid login tokens and impersonate any user including administrators without needing legitimate credentials. An attacker can gain full control of the NocoBase instance, access all data, modify user accounts, and steal stored secrets.

Technologies: Nocobase. Vendors: NocoBase.

Quick answers

Is CVE-2025-13877 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-13877 being exploited in the wild.
How severe is CVE-2025-13877?
Medium severity, with a CVSS score of 5.6, published 2 December 2025.
Which products and versions are affected?
Nocobase <1.9.23, >=1.9.0-beta.1 <1.9.0-beta.18, >=2.0.0-alpha.1 <2.0.0-alpha.52.
Is there a fix for CVE-2025-13877?
A patch was published on 2025-12-09: Fixed in versions 1.9.23, 1.9.0-beta.18, and 2.0.0-alpha.52 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-13877 attacked?
It is attacked over the network.
Am I affected by CVE-2025-13877?
Check whether you run Nocobase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass caused by hardcoded or publicly documented default JWT secrets in NocoBase's official Docker deployment configurations. An attacker can craft a valid JWT token using the known secret and a guessed or common userId (typically the administrator account), then use this forged token to bypass authentication and authorization checks entirely. The attack is network-accessible, requires no prior authentication or user interaction, and public proof-of-concept exploits are available. Successful exploitation allows the attacker to assume any user identity, access sensitive business data, create or delete users, and retrieve cloud storage credentials. The patch redesigns JWT key management to forbid public defaults, require explicit user-provided secrets or cryptographically secure random generation, and validate secret strength at startup.

Affected products

  • NocoBase NocoBase <1.9.23, >=1.9.0-beta.1 <1.9.0-beta.18, >=2.0.0-alpha.1 <2.0.0-alpha.52

Identifiers

  • CVE-2025-13877
  • GHSA-mv7p-34fv-4874

Timeline

  • 2025-12-09: disclosed
  • 2025-12-09: patched: Fixed in versions 1.9.23, 1.9.0-beta.18, and 2.0.0-alpha.52

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.