CVE-2025-53960

When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/xlpvfzf5l5m5mfyjwrz5h4dssm3c32vy	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/04/1	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Al emitir JSON Web Tokens (JWT), Apache StreamPark utiliza directamente la contraseña del usuario como clave de firma HMAC (por ejemplo, con el algoritmo HS256). Un atacante puede explotar esta vulnerabilidad para realizar ataques de fuerza bruta offline sobre la contraseña del usuario utilizando un JWT capturado, o para falsificar arbitrariamente tokens de identidad para el usuario si la contraseña ya es conocida, lo que finalmente lleva a una toma de control completa de la cuenta. Este problema afecta a Apache StreamPark: desde la versión 2.0.0 hasta antes de la 2.1.7. Se recomienda a los usuarios actualizar a la versión 2.1.7, que corrige el problema.

Information

Published : 2025-12-12 16:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-53960

Mitre link : CVE-2025-53960

CVE.ORG link : CVE-2025-53960

JSON object : View

Products Affected

apache

streampark

CWE

CWE-1240

Use of a Cryptographic Primitive with a Risky Implementation

{"id": "CVE-2025-53960", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-53960", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T18:47:19.959060Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache StreamPark", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.1.7", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-12T16:15:44.463", "references": [{"url": "https://lists.apache.org/thread/xlpvfzf5l5m5mfyjwrz5h4dssm3c32vy", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/12/04/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-1240"}]}], "descriptions": [{"lang": "en", "value": "When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover.\n\n\n\n\n\n\n\nThis issue affects Apache StreamPark: from 2.0.0 before 2.1.7.\n\nUsers are recommended to upgrade to version 2.1.7, which fixes the issue."}, {"lang": "es", "value": "Al emitir JSON Web Tokens (JWT), Apache StreamPark utiliza directamente la contrase\u00f1a del usuario como clave de firma HMAC (por ejemplo, con el algoritmo HS256). Un atacante puede explotar esta vulnerabilidad para realizar ataques de fuerza bruta offline sobre la contrase\u00f1a del usuario utilizando un JWT capturado, o para falsificar arbitrariamente tokens de identidad para el usuario si la contrase\u00f1a ya es conocida, lo que finalmente lleva a una toma de control completa de la cuenta.\n\nEste problema afecta a Apache StreamPark: desde la versi\u00f3n 2.0.0 hasta antes de la 2.1.7.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.1.7, que corrige el problema."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18BD3C9F-61F6-4D68-B0E7-333A94F827ED", "versionEndExcluding": "2.1.7", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}