CVE-2020-37281

8.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-1394

Impact

Unauthenticated attackers can bypass authentication and gain full administrator control over the platform via the Management API. They only need network access and knowledge of a valid user ID to forge bearer tokens.

Root cause

The Management API ships with a static default `jwt.secret` configuration used to verify HS256-signed JWTs.

Affected systems

Gravitee API Management through 4.12.22

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Specific fixed versions are not listed in the advisory. Immediately mitigate by overriding the default `jwt.secret` in `gravitee.yml` (or via Helm values) with a strong, random secret and restarting the API service.

shell

$ grep -rn 'jwt.secret' /path/to/gravitee-apim-rest-api/config/

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.

References

Source: nvd.nist.gov/vuln/detail/CVE-2020-37281