CVE-2025-53960: Apache StreamPark: Uses the user’s password as the secret key
When encrypting sensitive data, weak encryption keys that are fixed or directly generated based on user passwords are used. Attackers can obtain these keys through methods such as reverse engineering, code leaks, or password guessing, thereby decrypting stored or transmitted encrypted data, leading to the leakage of sensitive information.
This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.
Users are recommended to upgrade to version 2.1.7, which fixes the issue.
Other sources
When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge identity tokens for the user if the password is already known, ultimately leading to complete account takeover.
This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.
Users are recommended to upgrade to version 2.1.7, which fixes the issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53960?
CVE-2025-53960 is considered a critical vulnerability due to the usage of weak encryption keys that can be easily exploited by attackers.
How do I fix CVE-2025-53960?
To remediate CVE-2025-53960, upgrade to Apache StreamPark version 2.1.7 or later.
What applications are affected by CVE-2025-53960?
CVE-2025-53960 affects Apache StreamPark versions between 2.0.0 and 2.1.6.
What risks are associated with CVE-2025-53960?
The risks associated with CVE-2025-53960 include unauthorized access to sensitive data due to weak encryption keys.
Can CVE-2025-53960 be exploited remotely?
Yes, CVE-2025-53960 can be exploited remotely if an attacker has access to the encrypted data.