{"id":"EUVD-2025-200266","enisaUuid":"e7d7167f-fb2c-3fb4-bd3d-3e27a6cb86c2","description":"A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. The affected element is an unknown function of the file nocobase\\packages\\core\\auth\\src\\base\\jwt-service.ts of the component JWT Service. The manipulation of the argument API_KEY results in use of hard-coded cryptographic key\r . The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","datePublished":"Dec 2, 2025, 4:02:05 PM","dateUpdated":"Dec 2, 2025, 4:18:30 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://vuldb.com/?id.334033\nhttps://vuldb.com/?ctiid.334033\nhttps://vuldb.com/?submit.692205\nhttps://gist.github.com/H2u8s/f3ede60d7ecfe598ae452aa5a8fbb90d\n","aliases":"CVE-2025-13877\nGHSA-644f-hrff-mf96\nGHSA-mv7p-34fv-4874\n","assigner":"VulDB","epss":0.3,"enisaIdProduct":[{"id":"02886bfe-66dc-3aa2-a9a8-869db0efadc5","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.9"},{"id":"0da6186c-95d7-3bb6-ac5d-3a4e054fec14","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.36"},{"id":"18d81673-dadf-3be5-bc89-c7e4336426af","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.32"},{"id":"1a32df4e-6720-360f-8b8c-c550c7c9f18f","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.8"},{"id":"1c90a21f-679f-3574-a681-e7d174b5554d","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.21"},{"id":"21786214-f2d3-358d-bff0-7f0ac06c0913","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.29"},{"id":"2299f77e-537d-3f2d-b3b8-8aa6d7135953","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.7"},{"id":"3fd1bf60-e5ce-3810-a1ef-6bb90e8985dc","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.35"},{"id":"400fa9a1-1538-3b2a-945d-20ebdf79ec10","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.25"},{"id":"425c67c9-5e94-32e9-9d69-0fce6c57f754","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.23"},{"id":"45fd6abc-02d1-3dd9-9e3e-5684faf888b4","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.24"},{"id":"4b2d7d55-f5a8-32e5-aaef-c693e4215307","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.15"},{"id":"56182f95-5747-39e8-8a5b-114cb9c82d90","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.27"},{"id":"5b9d2eb6-a2fb-3af8-a7d8-6f1b466f8ac1","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.4"},{"id":"6570b810-cd54-3970-8e55-8a520a743d43","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.12"},{"id":"68c0f00a-e034-3a1c-bb83-cdf653e2614d","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.2"},{"id":"6d8c3f3e-08e1-3e9b-a4c8-2500968ab00d","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.2"},{"id":"6f403cf7-c89e-3ed2-8333-557b9ca8ca74","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.6"},{"id":"6f4090ab-0c33-3cac-9b2b-f663b8aee04c","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.14"},{"id":"7d968485-c1f9-348a-8a00-c7909242c2c9","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.28"},{"id":"7faf066b-09c9-3865-88e1-793a225541cb","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.0"},{"id":"8b20d867-41be-3cde-b971-2ffaf8b3e8a5","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.33"},{"id":"8bc10476-cef1-3ac0-8f19-57079dd15469","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.5"},{"id":"96a1cc28-6d16-3c12-b109-6690571c65bf","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.3"},{"id":"9828b79c-3f00-3565-a901-2f9f6e7eb4c1","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.19"},{"id":"9fc22cf6-77b7-3eb1-9cc3-32336d5b2c47","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.13"},{"id":"a1ed96a7-f5df-3361-a13c-ce3064e7cbd6","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.3"},{"id":"a5efb525-cd8d-3b8b-8287-04be5a86950c","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.4"},{"id":"a7881229-c66c-3820-b37d-1db1d64e1dce","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.37"},{"id":"abd17887-5412-3c0b-a542-8224412eb1dd","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.10"},{"id":"b3b44560-96c2-3643-afe1-d03fed772253","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.17"},{"id":"bdf9cd99-d572-3632-9927-b89227cb9cd5","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.20"},{"id":"c1a01d35-c648-3a5b-ac5e-624a9f243a97","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.26"},{"id":"cde6e80e-ac4a-32e9-9a82-52c3495497d6","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.1"},{"id":"d18ef0ef-2d77-375e-b19a-bfb3ecb27a40","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.30"},{"id":"d460b57c-4a50-3d5b-9ed9-7b83dfb4cade","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.18"},{"id":"d4641014-1e02-32ef-a29a-e952cd2bb3b6","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.34"},{"id":"d919b990-4202-352c-8434-0c1b78a3f7a1","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.16"},{"id":"e54ca64c-c9b1-35f9-95ab-5b35b26e17ac","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.31"},{"id":"ef223983-fb52-307b-b2a8-347cd06bec9a","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.1"},{"id":"f17461b9-56b9-3af8-976b-51ad027bd37d","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.11"},{"id":"f219a0fd-5ed4-3234-90c9-2e28cf4d9ec8","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.22"},{"id":"fbcb8e1e-09c0-35a3-a237-d93e9eb0455e","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.0"}],"enisaIdVendor":[{"id":"554dfcd8-6e37-3b7a-ac78-cecd1df6b30a","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"0a06684c-1ec1-36cc-b3c9-6c8ab7b386ce","vulnerability":{"id":"GHSA-644f-hrff-mf96","description":"Duplicate Advisory: Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments","datePublished":"Dec 2, 2025, 6:30:35 PM","dateUpdated":"Dec 9, 2025, 5:42:41 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-13877\nhttps://gist.github.com/H2u8s/f3ede60d7ecfe598ae452aa5a8fbb90d\nhttps://vuldb.com/?ctiid.334033\nhttps://vuldb.com/?id.334033\nhttps://vuldb.com/?submit.692205\n","enisa_id":"EUVD-2025-200266\n","aliases":"GHSA-644f-hrff-mf96\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"419d37e4-b811-3d76-adaf-22b2eb16b231","vulnerability":{"id":"CVE-2025-13877","description":"A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. The affected element is an unknown function of the file nocobase\\packages\\core\\auth\\src\\base\\jwt-service.ts of the component JWT Service. The manipulation of the argument API_KEY results in use of hard-coded cryptographic key\r . The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","datePublished":"Dec 2, 2025, 4:02:05 PM","dateUpdated":"Dec 2, 2025, 4:18:30 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://vuldb.com/?id.334033\nhttps://vuldb.com/?ctiid.334033\nhttps://vuldb.com/?submit.692205\nhttps://gist.github.com/H2u8s/f3ede60d7ecfe598ae452aa5a8fbb90d\n","enisa_id":"EUVD-2025-200266\n","assigner":"VulDB","epss":0.3,"dataProcessed":"Nov 2, 2026, 7:18:11 AM","vulnerabilityProduct":[{"id":"0137e5ce-0573-3b83-9f07-351666d2afcf","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.25"},{"id":"01d7074c-e4d3-3d99-8fff-0114914d84e5","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.30"},{"id":"052f569c-11c8-3200-b44e-a4f90af1d457","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.29"},{"id":"072c9d2e-ae58-3e2b-9c85-b37d05b37950","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.10"},{"id":"143273b1-eee3-3373-a71c-efcf19384aa0","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.5"},{"id":"20b790b2-c84a-3949-b9b3-e308f9a8cda7","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.31"},{"id":"247f7daf-8473-3f8c-982d-22e6c5344b66","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.0"},{"id":"2a2c8b68-c0e0-3de4-9afd-27cb1a56dec5","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.12"},{"id":"2e62e95c-00c2-3c1c-a37f-39cf708d1519","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.26"},{"id":"33d2265f-ac11-3b27-b1bc-a681cd5b35c7","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.18"},{"id":"3447666d-da0a-3fad-b2c3-ab5570e7414d","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.3"},{"id":"36ad6d7a-16d6-3a1d-ab98-0e58946f2b3c","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.23"},{"id":"37721fe6-aa84-323d-a95a-f0f3fc8ce8a1","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.4"},{"id":"394790ab-c261-39cc-84f7-a4cd0135c6b5","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.13"},{"id":"399c00b8-58ae-31df-bbaf-04177b5cd437","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.34"},{"id":"3e4cdaae-2947-3693-84a8-cdf5ce8ce511","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.28"},{"id":"3ffc0c28-fc69-3356-a944-5524f5c1a322","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.3"},{"id":"50f6a3d3-942e-3167-85dd-c9990c61bbc5","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.4"},{"id":"67e4899e-0d86-3022-be8e-2ec43a157af0","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.11"},{"id":"6a0e3c7a-87f5-365c-9c08-8085b67e193c","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.22"},{"id":"71dbc24b-1356-39a9-b46c-52dd5236af80","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.35"},{"id":"74b4ecfd-d00f-3764-90fd-4e68ed8f5d8c","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.14"},{"id":"7c7b2d97-df31-3051-bf36-b0cf4ccfa07c","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.33"},{"id":"8437d6f6-5ae1-35d1-8924-9f44ecc6b534","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.8"},{"id":"885e4e52-3a03-30ab-9477-da2995e783d9","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.1"},{"id":"8e450ab1-71d4-3c53-a2d5-5f6ba0907d57","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.2"},{"id":"912ef756-08bf-3e68-a5b4-92c22df47b74","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.9"},{"id":"958fb0c1-10bc-3340-886a-b6ab7de39ff9","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.32"},{"id":"9b93bb98-bda7-32e0-8636-246df95d635a","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.36"},{"id":"9ebb29ea-c37a-3d1d-87a6-2a4d8052ccf1","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.16"},{"id":"a29f567a-d466-31fd-b710-0c169f4cf499","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.19"},{"id":"a572d761-f57c-3f4a-9073-33918c98b158","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.20"},{"id":"b5e003fb-26f5-3880-adf8-971e78d73b04","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.2"},{"id":"b81680cf-5803-35fa-83ba-e3dc037aa642","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.15"},{"id":"bdc00870-64d2-3638-99a3-4bb906027d88","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.24"},{"id":"c0495c56-48c9-3e1b-969c-49f471904a66","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.21"},{"id":"c3fd3c7f-95df-3b4f-aae5-129c6db75430","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.0"},{"id":"d3e81cf8-3f57-3027-822b-92dae4c5f3c8","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.27"},{"id":"dc444e37-dd65-3587-9b0c-d446a3f09cfc","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.7"},{"id":"e3bf2250-2fb6-38ce-801f-1cf435f630fc","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.6"},{"id":"ec830eb4-392c-3ce2-9ae1-ea57a321755b","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.37"},{"id":"f3ed8536-be1b-333b-b163-671eeaa2fb16","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"1.9.1"},{"id":"fdc25cdd-61c2-3910-9445-4d90f687bd9e","product":{"name":"nocobase","vendor":{"name":"nocobase"}},"product_version":"2.0.0-alpha.17"}],"vulnerabilityVendor":[{"id":"c981ae51-ec66-3f08-a1fb-2fc6645ed765","vendor":{"name":"n/a"}}]}},{"id":"55916b06-765e-3576-b4c2-023f11535422","vulnerability":{"id":"GHSA-mv7p-34fv-4874","description":"Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments","datePublished":"Dec 9, 2025, 5:42:53 PM","dateUpdated":"Dec 9, 2025, 5:42:53 PM","baseScore":0.0,"references":"https://github.com/nocobase/nocobase/security/advisories/GHSA-mv7p-34fv-4874\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-13877\nhttps://github.com/nocobase/nocobase/commit/de4292ea7847dd26c6306445091769f8b9ee96d5\nhttps://docs.nocobase.com/welcome/getting-started/installation/docker-compose\nhttps://gist.github.com/H2u8s/f3ede60d7ecfe598ae452aa5a8fbb90d\nhttps://github.com/nocobase/nocobase\nhttps://github.com/nocobase/nocobase/blob/main/docker/app-mariadb/docker-compose.yml#L13\nhttps://github.com/nocobase/nocobase/blob/main/docker/app-mysql/docker-compose.yml#L13\nhttps://github.com/nocobase/nocobase/blob/main/docker/app-postgres/docker-compose.yml#L11\nhttps://github.com/nocobase/nocobase/blob/main/docker/app-sqlite/docker-compose.yml#L11\nhttps://v2.docs.nocobase.com/get-started/installation/docker\nhttps://vuldb.com/?ctiid.334033\nhttps://vuldb.com/?id.334033\nhttps://vuldb.com/?submit.692205\n","enisa_id":"EUVD-2025-200266\n","aliases":"GHSA-mv7p-34fv-4874\nCVE-2025-13877\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}