{"id":"CVE-2026-100871","published":"2026-09-27T13:16:38.380","lastModified":"2026-09-28T20:55:27.360","description":"Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Sylius/Sylius","tags":[]},{"url":"https://github.com/Sylius/Sylius/commit/cdfb672a4d174eb2c73159b25cf5b5f44088f45c","tags":[]},{"url":"https://github.com/Sylius/Sylius/pull/19213","tags":[]},{"url":"https://github.com/Sylius/Sylius/releases/tag/v2.2.9","tags":[]},{"url":"https://github.com/Sylius/Sylius/security/advisories/GHSA-f6mx-qxjc-55xf","tags":[]},{"url":"https://www.vulncheck.com/advisories/sylius-before-1.12.25-1.13.17-1.14.20-2.1.16-and-2.2.9-jwt-audience-confusion-allows-admin-api-authentication","tags":[]}],"exploitRefs":[{"url":"https://github.com/Sylius/Sylius","tags":[]},{"url":"https://github.com/Sylius/Sylius/commit/cdfb672a4d174eb2c73159b25cf5b5f44088f45c","tags":[]},{"url":"https://github.com/Sylius/Sylius/pull/19213","tags":[]},{"url":"https://github.com/Sylius/Sylius/releases/tag/v2.2.9","tags":[]},{"url":"https://github.com/Sylius/Sylius/security/advisories/GHSA-f6mx-qxjc-55xf","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to obtain an administrator's token by registering a shop customer account with an administrator's email, granting full administrative access. This is due to the lack of firewall identification in JWT tokens issued by separate Admin and Shop API endpoints.","exploitability":"Exploitation is relatively straightforward if an attacker can register a shop customer account with an administrator's email. Precondition is access to the Shop API registration endpoint.","blast_radius":"If exploited, this could result in unauthorized administrative access and potential full control over the Sylius instance.","remediation":"Upgrade to Sylius version 1.12.25 or later, 1.13.17 or later, 1.14.20 or later, 2.1.16 or later, or 2.2.9 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","api","jwt","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:05:36.074Z"}}