{"action":"Upgrade @nocobase/auth to 1.9.0-beta.18 or later.","affected":[{"fixed":"1.9.23","introduced":"1.9.0"},{"fixed":"1.9.0-beta.18","introduced":"0"},{"fixed":"2.0.0-alpha.52","introduced":"2.0.0-alpha.1"}],"component":"@nocobase/auth","cve_ids":["CVE-2025-13877"],"ecosystem":"npm","epss":0.00328,"exploited":false,"fixed_versions":["1.9.23","1.9.0-beta.18","2.0.0-alpha.52"],"ghsa_id":"GHSA-mv7p-34fv-4874","id":"tcs_01M5KG1QH99YS0F611K90P0Y0Z","modified_at":"2025-12-09T17:57:52.568117Z","published_at":"2025-12-09T17:42:53Z","references":["https://osv.dev/vulnerability/GHSA-mv7p-34fv-4874","https://github.com/nocobase/nocobase/security/advisories/GHSA-mv7p-34fv-4874","https://nvd.nist.gov/vuln/detail/CVE-2025-13877","https://github.com/nocobase/nocobase/commit/de4292ea7847dd26c6306445091769f8b9ee96d5","https://docs.nocobase.com/welcome/getting-started/installation/docker-compose","https://gist.github.com/H2u8s/f3ede60d7ecfe598ae452aa5a8fbb90d","https://github.com/nocobase/nocobase","https://github.com/nocobase/nocobase/blob/main/docker/app-mariadb/docker-compose.yml#L13","https://github.com/nocobase/nocobase/blob/main/docker/app-mysql/docker-compose.yml#L13","https://github.com/nocobase/nocobase/blob/main/docker/app-postgres/docker-compose.yml#L11","https://github.com/nocobase/nocobase/blob/main/docker/app-sqlite/docker-compose.yml#L11","https://v2.docs.nocobase.com/get-started/installation/docker","https://vuldb.com/?ctiid.334033","https://vuldb.com/?id.334033","https://vuldb.com/?submit.692205"],"severity":{"label":"medium","score":5.6},"sources":[{"source":"osv","source_id":"GHSA-mv7p-34fv-4874","url":"https://osv.dev/vulnerability/GHSA-mv7p-34fv-4874"},{"source":"nvd","source_id":"CVE-2025-13877","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13877"}],"summary":"Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments"}