CVE-2020-37281: Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-27
Weakness: CWE-1394

Description

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.

Affected products

Gravitee API Management: through 4.12.22

References

https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-management/gravitee-apim-rest-api-management-security/src/main/java/io/gravitee/rest/api/management/security/config/BasicSecurityConfigurerAdapter.java#L157-L175
https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-standalone/gravitee-apim-rest-api-standalone-distribution/src/main/resources/config/gravitee.yml#L636-L637
https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/helm/values.yaml#L103
https://github.com/gravitee-io/gravitee-docs/blob/master/pages/apim/3.x/how-tos/how-to-general-configuration.adoc
https://github.com/gravitee-io/issues/issues/4204
https://www.vulncheck.com/advisories/gravitee-api-management-through-4.12.22-default-jwt-secret-authentication-bypass

Get alerted when CVE-2020-37281 or the next vulnerability affects your stack