-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @nocobase/auth | npm | <= 1.9.21 | 1.9.23 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the use of a default, hardcoded JWT secret in NocoBase docker-compose deployments. The application's JwtService constructor would fall back to using the APP_KEY environment variable if no specific secret was provided. The default docker-compose.yml files provided by NocoBase used a weak, publicly known value for APP_KEY ('your-secret-key').
An attacker could leverage this knowledge to sign their own JWT tokens with the default secret, effectively bypassing authentication and gaining unauthorized access to the application. The patch addresses this by modifying the AuthManager to generate a strong, random, and persistent secret if one is not explicitly configured. This ensures that each installation uses a unique secret, preventing attackers from forging tokens.
JwtService.constructorpackages/core/auth/src/base/jwt-service.ts
AuthManager.constructorpackages/core/auth/src/auth-manager.ts
JwtService.decodepackages/core/auth/src/base/jwt-service.ts