Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments

Description

CVE-2025-13877 is an authentication bypass vulnerability caused by insecure default JWT key usage in NocoBase Docker deployments.

Because the official one-click Docker deployment configuration historically provided a public default JWT key, attackers can forge valid JWT tokens without possessing any legitimate credentials.

Recommendation

Update the @nocobase/auth package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 2.0.0-alpha.1, <= 2.0.0-alpha.51

  <= 1.9.0-beta.17

  >= 1.9.0, <= 1.9.21**

• Patched version(s): **2.0.0-alpha.52

  1.9.0-beta.18

  1.9.23**

References

• GHSA-mv7p-34fv-4874
• docs.nocobase.com
• v2.docs.nocobase.com
• vuldb.com
• CVE-2025-13877
• CWE-1320
• CWE-321
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985
• OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover - CVE-2026-44720
• hemmelig allows SSRF Filter bypass via Secret Request functionality - CVE-2025-69206
• Misskey has a login rate limit bypass via spoofed X-Forwarded-For header - CVE-2025-66482

You might also like:

How do hackers hack websites?

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Update Cheat Sheet for Developers

Tags:

npm

@nocobase/auth