Vulnerabilities

TI-2026-65009 CVE-2026-100871 · GHSA-mxrg-842r-h599

Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication

LOW 39

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00309 Published 2026-09-27 Fixed in 1.12.25, 1.13.17 +3 CWE-287

TI-2026-65008 CVE-2026-100870 · GHSA-753f-ggfx-2h8w

Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

LOW 39

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens t…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00311 Published 2026-09-27 Fixed in 1.12.25, 1.13.17 +3 CWE-640

Vulnerabilities

Filters

Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication

Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header