CVE-2026-100871CWE-287

CVE-2026-100871

High · published September 27, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00309 · 22.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-27T17:16Z
References (6)
https://github.com/Sylius/Sylius · [email protected]https://github.com/Sylius/Sylius/commit/cdfb672a4d174eb2c73159b25cf5b5f44088f45c · [email protected]https://github.com/Sylius/Sylius/pull/19213 · [email protected]https://github.com/Sylius/Sylius/releases/tag/v2.2.9 · [email protected]https://github.com/Sylius/Sylius/security/advisories/GHSA-f6mx-qxjc-55xf · [email protected]https://www.vulncheck.com/advisories/sylius-before-1.12.25-1.13.17-1.14.20-2.1.16-and-2.2.9-jwt-audience-confusion-allows-admin-api-authentication · [email protected]
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 27 SEP 13:09Z
    Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
    cvelistv5