nest-admin Hardcoded JWT Secret Admin Authentication Bypass

nest-admin before 1.0.1 has an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens.

The cause is a hardcoded JWT_SECRET committed in .env.production. Because JwtStrategy and RbacGuard trust this known secret, attackers can:

• sign tokens impersonating any user ID, or
• claim the admin role for full administrative access.

Full administrative access is possible without authentication.