Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Apache StreamPark 2.1.7 Clear all filters
TI-2025-33818 CVE-2025-53960 · GHSA-3hg2-rh4r-8qf6

Apache StreamPark: Uses the user’s password as the secret key

Priority LOW 26

When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00261 Published 2025-12-12 Fixed in 2.1.7 CWE-1240
TI-2025-34667 CVE-2025-54947 · GHSA-prv5-c2px-j9q3

Apache StreamPark: Use hard-coded key vulnerability

Priority MEDIUM 49

In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00478 Published 2025-12-12 Fixed in 2.1.7 CWE-321
TI-2025-34690 CVE-2025-54981 · GHSA-749j-2hp6-8cxm

Apache StreamPark: Weak Encryption Algorithm in StreamPark

Priority LOW 38

Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing sensitive authentication data…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0024 Published 2025-12-12 Fixed in 2.1.7 CWE-327