CVE-2025-53960

Katalog CVE

CVSS 5.9 · Medium EPSS 0,26%

Kerentanan Use of a Cryptographic Primitive with a Risky Implementation pada apache streampark. Skor CVSS 3.1 5.9 (Medium) menurut CISA ADP.

Deskripsi (NVD)

When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.

Rincian

Terbit di NVD

12 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/xlpvfzf5l5m5mfyjwrz5h4dssm3c32vy mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/12/04/1 mailing list · advisory pihak ketiga