CVE-2025-13877: 
JavaScript vulnerability analysis and mitigation

CVE-2025-13877 is an authentication bypass vulnerability in NocoBase caused by the use of a hard-coded, publicly known default JWT secret in official Docker deployment configurations. Attackers who know the default APP_KEY value (e.g., your-secret-key) can forge valid JWT tokens and impersonate any user, including administrators, without possessing legitimate credentials. The vulnerability affects NocoBase versions up to 1.9.4 (stable) and 2.0.0-alpha.37 (alpha), specifically deployments using the default Docker Compose configuration without overriding the JWT secret. It was first published on December 2, 2025, with a GitHub Advisory issued on December 9, 2025. The CVSS v3.1 base score is 5.6 (Medium), while the CVSS v4.0 base score is 6.3 (Medium) (GitHub Advisory, VulDB).

The root cause is classified as CWE-321 (Use of Hard-coded Cryptographic Key). The official NocoBase Docker Compose files for MySQL, MariaDB, PostgreSQL, and SQLite deployments historically set APP_KEY=your-secret-key as a placeholder that many operators never changed. The JwtService class in nocobase/packages/core/auth/src/base/jwt-service.ts reads this key via process.env.APP_KEY and uses it to sign and verify JWTs with the jsonwebtoken library. Because the key is publicly known from the open-source repository, an attacker can craft a JWT with an arbitrary userId (e.g., 1 for the administrator) and a valid signature, which passes all server-side verification checks including signature validation, blacklist checks, and session expiry logic. The attack requires no authentication and is remotely exploitable, though it carries high attack complexity due to the need to identify the target's userId and construct a properly formatted token (GitHub Advisory, PoC Gist).

Successful exploitation allows an attacker to completely bypass authentication and impersonate any user, including system administrators. An attacker can access sensitive business data, create or delete users, modify system configurations, and retrieve cloud storage credentials (e.g., OSS keys) stored within the platform. Because administrator access is achievable with userId=1, the impact effectively constitutes full application compromise, with potential for lateral movement to connected cloud services and data stores (GitHub Advisory, PoC Gist).

A public proof-of-concept exploit was published on GitHub Gist by researcher H2u8s on November 10, 2025, prior to the CVE's formal publication on December 2, 2025, demonstrating successful authentication bypass against a locally deployed NocoBase Docker instance (PoC Gist). The EPSS score is approximately 0.038% (16th percentile), indicating a currently low but non-zero probability of exploitation in the wild. No threat actor attribution or confirmed in-the-wild exploitation campaigns have been reported, and the vulnerability is not listed in the CISA KEV catalog. The exploit is straightforward for any attacker who identifies a target running the default Docker configuration (GitHub Advisory).

1. Reconnaissance: Identify internet-facing NocoBase instances using tools like Shodan or Censys, searching for the NocoBase login page or API endpoints. Confirm the target is running a Docker-based deployment.
2. Confirm default key: Check whether the target was deployed using the official NocoBase Docker Compose files without customizing APP_KEY. The default value your-secret-key is publicly documented in the repository.
3. Identify target userId: Through black-box analysis or by observing API responses, determine the administrator's userId. In default NocoBase deployments, the administrator account consistently uses userId=1.
4. Forge JWT token: Using the known default secret (your-secret-key), craft a JWT with the following payload using any JWT library or tool (e.g., jwt.io, Python PyJWT):

   { "userId": 1, "iat": <current_unix_timestamp>, "exp": <far_future_timestamp> }

   Sign it with HS256 and the secret your-secret-key. An example forged token from the PoC: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsImlhdCI6MTc2MjMxMDI4MSwiZXhwIjoxNzM2MjIwMTk2MDB9.IiC9Tr-P5j5Vq0vWHV4riiozj2iG3Po8Z6Cf2yBm-3k
5. Send authenticated request: Include the forged token as a Bearer token in the Authorization header of HTTP requests to the NocoBase API (e.g., /api/users, /api/roles, /api/storages).
6. Achieve full administrator access: The server validates the JWT signature successfully and grants full administrator privileges, enabling data exfiltration, user management, and access to cloud storage credentials (PoC Gist, GitHub Advisory).

• Network: Unexpected API requests to sensitive NocoBase endpoints (e.g., /api/users, /api/roles, /api/storages, /api/systemSettings) from unfamiliar IP addresses; requests with Authorization: Bearer tokens that do not correspond to any active user session.
• Logs: NocoBase application logs showing successful authentication events for the administrator account (userId=1) from unusual IP addresses or at unusual times; absence of a corresponding login event in the authentication log prior to API access.
• JWT Analysis: JWT tokens in HTTP request headers with userId=1, a very long exp value (e.g., year 2024+), and a signature verifiable with the string your-secret-key; tokens lacking a jti claim or with a jti not present in the token controller database.
• Application Behavior: Unexpected creation, modification, or deletion of user accounts; unauthorized changes to system configuration or storage credentials; new administrator-level accounts appearing without corresponding audit trail entries (PoC Gist, GitHub Advisory).

NocoBase has released patched versions that enforce secure JWT key management: 1.9.23, 1.9.0-beta.18, and 2.0.0-alpha.52. The fix redesigns JWT secret handling so that secrets can no longer fall back to public default values — they must be explicitly provided or securely generated with cryptographic randomness at first startup, and weak/default values trigger an immediate startup failure. For deployments that cannot upgrade immediately, operators must: (1) explicitly set a strong, randomly generated value for APP_KEY in docker-compose.yml or .env files; (2) restart all NocoBase instances to apply the new secret; (3) invalidate all existing JWT sessions to force re-authentication; and (4) audit docker-compose.yml, .env, and Kubernetes Secrets for any remaining default values (GitHub Advisory).

The vulnerability was reported by researcher H2u8s, who noted its functional equivalence to similar JWT secret exposure vulnerabilities CVE-2024-43441 and CVE-2025-30206, highlighting a recurring pattern of insecure default secrets in open-source platforms deployed via Docker. The GitHub Advisory notes that the vendor did not respond to early disclosure contact, and the PoC was published prior to the CVE's formal assignment. The advisory was subsequently published by a community contributor (2013xile) to the NocoBase repository on December 9, 2025 (GitHub Advisory, PoC Gist).