Read the docs
TI-2025-33818 Aliases CVE-2025-53960GHSA-3hg2-rh4r-8qf6

Apache StreamPark: Uses the user’s password as the secret key

Priority LOW 26CWE-1240Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 17th percentileScored 2026-11-07
Fix Fixed Apache StreamPark (Apache Software Foundation): 2.1.7org.apache.streampark:streampark (Maven): 2.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache StreamPark2.0.0 to before 2.1.72.1.7Patch availableCNA
—org.apache.streampark:streampark (Maven)2.0.0 to before 2.1.72.1.7Patch availableGHSA-3hg2-rh4r-8qf6
  • Apache StreamPark VendorApache Affected 2.0.0 to before 2.1.7 Fixed in 2.1.7 Patch available CNA
  • org.apache.streampark:streampark (Maven) Vendor— Affected 2.0.0 to before 2.1.7 Fixed in 2.1.7 Patch available GHSA-3hg2-rh4r-8qf6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*2.0.0 to before 2.1.7VulnerableApache
  • cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.1.7 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache StreamPark (Apache Software Foundation) Fixed in 2.1.7
  • Fix · GHSA-3hg2-rh4r-8qf6 org.apache.streampark:streampark (Maven) Fixed in 2.1.7 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache StreamPark 2.1.7

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-34667 Apache StreamPark: Use hard-coded key vulnerabilityPriority MEDIUM 49
    • TI-2025-34690 Apache StreamPark: Weak Encryption Algorithm in StreamParkPriority LOW 38
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53960
  2. 2026-10-03 Alias added: GHSA-3hg2-rh4r-8qf6

References

Advisory 3

Other 2

  • TI-2022-22606 Apache StreamPark (incubating): Upload any file to any directory CVSS 3.1CRITICAL 9.8
  • TI-2025-34667 Apache StreamPark: Use hard-coded key vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-19248 Apache StreamPark: session not invalidated after logout CVSS 3.1CRITICAL 9.1
  • TI-2022-22908 Apache StreamPark (incubating): Logic error causing any account reset CVSS 3.1CRITICAL 9.1
  • TI-2024-19347 Apache StreamPark: FreeMarker SSTI RCE Vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-28690 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences