Executive brief
NocoBase is a low-code application platform often deployed via Docker Compose. This vulnerability allows unauthenticated attackers to forge authentication tokens using a hardcoded default JWT secret that remains unchanged in typical deployments. An attacker can gain administrator privileges, access sensitive data, modify user accounts, and extract cloud storage credentials.
Technical details
The vulnerability exists in the JWT Service component (jwt-service.ts) which uses a hardcoded or easily discoverable default API_KEY/APP_KEY for signing and verifying JSON Web Tokens. The issue affects docker-compose deployments where administrators do not override the default JWT secret during setup. Although the official documentation recommends changing the secret, it is not enforced, leaving many deployments vulnerable. An attacker with network access can craft valid JWTs for any user, including administrators, without authentication. The fix was released in version 1.9.23.
Affected products
- NocoBase NocoBase up to 1.9.21
Timeline
- 2025-12-02: disclosed
- 2025-12-09: other: Advisory withdrawn as duplicate of GHSA-mv7p-34fv-4874
- 2025-12-02: patched: Fixed in version 1.9.23