CVSS 3.1
5.1 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2021-27884
Medium (5.1) in ymfe yapi. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in yapi-vendor 1.9.3.
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
- CWE
- CWE-330
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ymfe:yapi
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2h3h-vw8r-82rp | npm | yapi-vendor | <1.9.3 | 1.9.3 |