Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Sylius lets attackers log into admin API with fake token

CVE-2026-100871 · published 22 days ago
Summary

Versions of Sylius listed above issue login tokens that do not identify which part of the system created them. An attacker can create a regular shop account using an admin's email, get a token, and then use it to access the admin functions as if they were that administrator. Upgrade Sylius to the latest patched versions or apply the vendor's recommended fix to ensure tokens correctly identify their source.

What to do
  • Update sylius sylius to version 1.12.25 or later.
Affected software
VendorProductAffected versions
sylius sylius < 1.12.25
Original advisory text
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published27 Sep 2026
Updated19 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-100871 · NVD
CVE-2026-100871 · MITRE
CVE-2026-100871 · OSV
GHSA-f6mx-qxjc-55xf · GHSA
Track software like this
Free during beta