CVE-2025-53960
Medium
Description
When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Apache Streampark
PublishedDec 12, 2025
First seenDec 12, 2025
Weakness typeCWE-1240CWE-1240
How to fix
Update
- apache streampark2.1.7 or later
- org.apache.streampark:streampark2.1.7 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache streampark | 2.0.0 ≤ v < 2.1.7 | 2.1.7 |
| org.apache.streampark:streamparkMaven | 2.0.0 ≤ v < 2.1.7 | 2.1.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.