What’s Vulnerable › Vulnerabilities

CVE-2025-53960: Apache StreamPark: Uses the user’s password as the secret key

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-12 · updated 2026-10-07
• Weakness: CWE-1240

Description

When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.

Affected products

• Apache Software Foundation Apache StreamPark: from 2.0.0 before 2.1.7 — fixed in 2.1.7

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache StreamPark 2.1.7. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/xlpvfzf5l5m5mfyjwrz5h4dssm3c32vy
• http://www.openwall.com/lists/oss-security/2025/12/04/1

Get alerted when CVE-2025-53960 or the next vulnerability affects your stack