CVE-2025-53960 describes a critical vulnerability in Apache StreamPark versions 2.0.0 through 2.1.6, where JSON Web Tokens (JWTs) are signed using the user's password directly as the HMAC key. This allows attackers to perform offline brute-force attacks on captured JWTs or forge identity tokens for known passwords, leading to complete account takeover. The vulnerability is rated Medium severity (CVSS 5.9) due to its network attack vector and high impact on confidentiality, despite requiring high attack complexity. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE. Users are strongly advised to upgrade to Apache StreamPark version 2.1.7 to remediate this issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.0.0, < 2.1.7CPE matchmatch criteria | cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.