https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:30:52 +0000 https://cve.radiocsirt.org/vuln/cve-2025-53960 <p><strong>Affected:</strong> Apache Software Foundation Apache StreamPark</p> <p>When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user&#39;s password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user&#39;s password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover.</p> <p>This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.</p> <p>Users are recommended to upgrade to version 2.1.7, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache StreamPark</p> <p>When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user&#39;s password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user&#39;s password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover.</p> <p>This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.</p> <p>Users are recommended to upgrade to version 2.1.7, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2025-53960