Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Gravitee API Management lets attackers pose as any user

CVE-2020-37281 · published 9 days ago
Summary

The Gravitee API Management platform (up to version 4.12.22) uses a default secret key for its JSON Web Token authentication. Because this key is known, an attacker can create a fake token that appears to belong to any user, including administrators, and gain full control of the system. Change the secret key to a strong, unique value and apply any available updates to remove the default setting.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gravitee gravitee api management <= 4.12.22
Original advisory text
Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-1394Use of Default Cryptographic Key
Timeline
Published14 Oct 2026
Updated22 Oct 2026
First seen14 Oct 2026
Sources
CVE-2020-37281 · NVD
CVE-2020-37281 · MITRE
CVE-2020-37281 · OSV
Track software like this
Free during beta