GHSA-mv7p-34fv-4874
NoneCVSS
—
EPSS
—
Published
Dec 9, 2025
CISA due date
—
The record
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @nocobase/auth | 0 | 1.9.0-beta.18 |
| npm | @nocobase/auth | 1.9.0 | 1.9.23 |
| npm | @nocobase/auth | 2.0.0-alpha.1 | 2.0.0-alpha.52 |
Related vulnerabilities
- CVE-2025-13877 A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. Same vulnerability
- GHSA-644f-hrff-mf96 Duplicate Advisory: Authentication Bypass via Default JWT Secret in NocoBase… Also affects @nocobase/auth
- CVE-2026-79735 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78486 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78481 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption… CWE-321
- CVE-2026-81821 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards… CWE-321
- CVE-2026-80057 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321