{"cve":"CVE-2025-53960","nvd":{"published":"2025-12-12T16:15:44.463","modified":"2026-10-07T20:10:01.970","status":"Analyzed","description":"When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover.\n\n\n\n\n\n\n\nThis issue affects Apache StreamPark: from 2.0.0 before 2.1.7.\n\nUsers are recommended to upgrade to version 2.1.7, which fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9},"cwes":["CWE-1240"],"references":["https://lists.apache.org/thread/xlpvfzf5l5m5mfyjwrz5h4dssm3c32vy","http://www.openwall.com/lists/oss-security/2025/12/04/1"],"products":["apache:streampark"],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2025-53960","score":0.00261,"percentile":0.17649,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-3hg2-rh4r-8qf6","url":"https://osv.dev/vulnerability/GHSA-3hg2-rh4r-8qf6","summary":"Apache StreamPark: Use the user’s password as the secret key Vulnerability","modified":"2025-12-20T03:08:02.215079Z","packages":[{"ecosystem":"Maven","name":"org.apache.streampark:streampark","purl":"pkg:maven/org.apache.streampark/streampark","ranges":[">=2.0.0 <2.1.7"],"fixed":["2.1.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}