CVE-2025-13877
1 advisory.
npm/@nocobase/auth CVE-2025-13877: medium
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
Action: Upgrade @nocobase/auth to 1.9.0-beta.18 or later.
npm i @nocobase/auth@1.9.23npm i @nocobase/auth@1.9.0-beta.18npm i @nocobase/auth@2.0.0-alpha.52Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.9.0 | 1.9.23 | - |
| 0 | 1.9.0-beta.18 | - |
| 2.0.0-alpha.1 | 2.0.0-alpha.52 | - |
Fixed versions
| 1.9.23 | 1.9.0-beta.18 | 2.0.0-alpha.52 |
Sources
- osv: GHSA-mv7p-34fv-4874
- https://github.com/nocobase/nocobase/security/advisories/GHSA-mv7p-34fv-4874
- https://nvd.nist.gov/vuln/detail/CVE-2025-13877
- https://github.com/nocobase/nocobase/commit/de4292ea7847dd26c6306445091769f8b9ee96d5
- https://docs.nocobase.com/welcome/getting-started/installation/docker-compose
- https://gist.github.com/H2u8s/f3ede60d7ecfe598ae452aa5a8fbb90d
- https://github.com/nocobase/nocobase
- https://github.com/nocobase/nocobase/blob/main/docker/app-mariadb/docker-compose.yml#L13
- https://github.com/nocobase/nocobase/blob/main/docker/app-mysql/docker-compose.yml#L13
- https://github.com/nocobase/nocobase/blob/main/docker/app-postgres/docker-compose.yml#L11
- https://github.com/nocobase/nocobase/blob/main/docker/app-sqlite/docker-compose.yml#L11
- https://v2.docs.nocobase.com/get-started/installation/docker
- https://vuldb.com/?ctiid.334033
- https://vuldb.com/?id.334033
- https://vuldb.com/?submit.692205
CVE-2025-13877 · published · modified · JSON