The @decido/backend-core package exports Express middleware for authentication that short-circuits JWT verification when the Authorization header contains the hardcoded bearer tokens 'mock-admin-token' or 'mock-token-123'. These tokens bypass normal authentication checks and grant fixed ADMIN or STUDENT identities, respectively. Because these tokens are hardcoded and publicly known, any application using this middleware is vulnerable to unauthorized access by attackers who supply these tokens in HTTP requests.

Applications using the affected versions of @decido/backend-core that integrate this middleware are vulnerable to unauthorized access. Attackers can gain administrative privileges or student-level access by supplying the known hardcoded tokens, bypassing all normal authentication and permission checks. This can lead to unauthorized user listing, role changes, and permission editing within the affected applications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the affected versions of @decido/backend-core or remove/replace the vulnerable middleware that accepts hardcoded tokens. Do not deploy applications with this middleware in production environments.