CVE-2025-53960: medium-severity vulnerability in Apache StreamPark
Apache StreamPark: Uses the user’s password as the secret key
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Apache StreamPark uses user passwords as the secret key to sign authentication tokens (JWTs). If an attacker captures a token, they can guess the password offline, or if they already know the password, they can create fake tokens to impersonate any user.
The vulnerability exists in JWT generation where user passwords are directly used as HMAC signing keys instead of a dedicated secret. An attacker with a captured JWT can perform offline brute-force attacks against the password, or with a known password can forge arbitrary identity tokens, enabling complete account compromise. Affected versions: 2.0.0 through 2.1.6.
In the same product, most dangerous first.