CVE-2023-22495: Izanami is vulnerable to Authorization Bypass

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-14 · updated 2026-06-17
Weakness: CWE-288

Description

Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the authentication token (JWT), an attacker could compromise another instance of Izanami. This issue has been patched in version 1.11.0.

Affected products

MAIF izanami: before 1.11.0 — fixed in 1.11.0

How to fix

Upgrade to a fixed version: MAIF izanami 1.11.0. Check the vendor advisory for mitigations.

References

https://github.com/MAIF/izanami/releases/tag/v1.11.0
https://github.com/MAIF/izanami/security/advisories/GHSA-9r7j-m337-792c
https://github.com/MAIF/izanami/releases/tag/v1.11.0
https://github.com/MAIF/izanami/security/advisories/GHSA-9r7j-m337-792c

Get alerted when CVE-2023-22495 or the next vulnerability affects your stack