CVE-2025-53960CWE-1240

CVE-2025-53960

Medium · published December 12, 2025

CVSS v3.1
5.9
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover.

This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.

Users are recommended to upgrade to version 2.1.7, which fixes the issue.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.8th percentile
Weakness
CWE-1240 · Use of a Cryptographic Primitive with a Risky Implementation
Published
2025-12-12T21:15Z
Affected products (1)
ProductVersionsFixed in
apache/streampark≥ 2.0.0, < 2.1.72.1.7
References (2)
https://lists.apache.org/thread/xlpvfzf5l5m5mfyjwrz5h4dssm3c32vy · [email protected]http://www.openwall.com/lists/oss-security/2025/12/04/1 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 12 DEC 15:15Z
    Apache StreamPark: Uses the user’s password as the secret key
    cvelistv5