8.8
CVE-2026-100871
- EPSS 0.31%
- Veröffentlicht 27.09.2026 13:16:38
- Zuletzt bearbeitet 30.09.2026 16:17:04
- Erkennungen
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerSylius
≫
Produkt
Sylius
Default Statusunaffected
Version
1.11.0
Version <
1.12.25
Status
affected
Version
1.13.0
Version <
1.13.17
Status
affected
Version
1.14.0
Version <
1.14.20
Status
affected
Version
2.0.0
Version <
2.1.16
Status
affected
Version
2.2.0
Version <
2.2.9
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.31% | 0.213 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| disclosure@vulncheck.com | 8.7 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| disclosure@vulncheck.com | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
https://github.com/Sylius/Sylius
https://github.com/Sylius/Sylius/releases/tag/v2.2.9
https://github.com/Sylius/Sylius/commit/cdfb672a4d174eb2c73159b25cf5b5f44088f45c
https://github.com/Sylius/Sylius/pull/19213
https://github.com/Sylius/Sylius/security/advisories/GHSA-f6mx-qxjc-55xf
https://www.vulncheck.com/advisories/sylius-before-1.12.25-1.13.17-1.14.20-2.1.16-and-2.2.9-jwt-audience-confusion-allows-admin-api-authentication