Gravitee API Management bypass authentication via default JWT secret
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Gravitee API Management through 4.12.22 ships with a default jwt.secret used to sign JSON Web Tokens, a default cryptographic key issue (CWE-1394). An unauthenticated remote attacker who knows an existing user ID can sign a token with that secret and impersonate any user, including administrators. The forged token is presented as a bearer token to the Management API, giving full control of the platform.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Gravitee API Management.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-14 Threatist record created from CVE-2020-37281
- 2026-10-14 Alias added: GHSA-vh3j-3qjc-g47j
- 2026-10-15 CISA SSVC decision points changed
- 2026-10-15 Priority changed: MEDIUM → LOW
- 2026-10-16 Priority changed: LOW → MEDIUM
References
Other 5
- https://github.com/gravitee-io/issues/issues/4204
- https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-standalone/gravitee-apim-rest-api-standalone-distribution/src/main/resources/config/gravitee.yml#L636-L637
- https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-management/gravitee-apim-rest-api-management-security/src/main/java/io/gravitee/rest/api/management/security/config/BasicSecurityConfigurerAdapter.java#L157-L175
- https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/helm/values.yaml#L103
- https://github.com/gravitee-io/gravitee-docs/blob/master/pages/apim/3.x/how-tos/how-to-general-configuration.adoc
More Gravitee vulnerabilities
- TI-2022-18247 Gravitee API Management before 3.15.13 allows path traversal through HTML injection. CVSS 3.1HIGH 8.6
- TI-2019-15214 HTML injection combined with path traversal in the Email service in Gravitee API… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-37281 · CVE Program
- CVE-2020-37281 · NVD
- FIRST EPSS
- GHSA-vh3j-3qjc-g47j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences