CVE-2020-37281 Details
Description
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.
An authentication bypass vulnerability has been identified in Gravitee API Management versions through 4.12.22. This vulnerability allows unauthenticated remote attackers to impersonate any user by forging JSON Web Tokens (JWTs) signed with the default jwt.secret. Attackers who know an existing user ID can create a token with that ID and present it to the Management API as a bearer token, effectively impersonating administrators and gaining full control of the platform.
Users are advised to update the JWT secret in the Gravitee configuration file to a custom value. Instructions for updating the JWT secret can be found in the Gravitee API Management documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1394 | Use of Default Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gravitee API Management | <= 4.12.22 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |