Medium, CVSS 6.3npmAmendedPublished
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
CVE-2025-13877 · GHSA-mv7p-34fv-4874
- Affected
- npm @nocobase/auth >= 1.9.0, <= 1.9.21; <= 1.9.0-beta.17; >= 2.0.0-alpha.1, <= 2.0.0-alpha.51
- Fixed in
- 1.9.232.0.0-alpha.521.9.0-beta.18· Vendor fix available
- Issue
- Impact CVE-2025-13877 is an authentication bypass vulnerability caused by insecure default JWT key usage in NocoBase Docker deployments. Because the official one-click Docker deployment configuration historically provided a public default JWT key, attackers can forge valid JWT tokens without possessing any legitimate credentials. By constructing a token with a known userId (commonly the administrator account), an attacker can directly bypass authentication and authorization checks. Successful exploitation allows an attacker to: - Bypass authentication entirely - Impersonate arbitrary users - Gain full administrator privileges - Access sensitive business data - Create, modify, or delete users - Access cloud storage credentials and other protected secrets The vulnerability is remotely exploitable, requires no authentication, and public proof-of-concept exploits are available. This issue is functionally equivalent in impact to other JWT secret exposure vulnerabilities such as…
Recommended action: Upgrade to 2.0.0-alpha.52 (pre-release), 1.9.23 or 1.9.0-beta.18 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.