CVE-2026-100871: Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Syliusto a version that resolves this vulnerability.Fixed in 1.12.25 - Upgrade
Upgrade
Syliusto a version that resolves this vulnerability.Fixed in 1.13.17 - Upgrade
Upgrade
Syliusto a version that resolves this vulnerability.Fixed in 1.14.20 - Upgrade
Upgrade
Syliusto a version that resolves this vulnerability.Fixed in 2.1.16 - Upgrade
Upgrade
Syliusto a version that resolves this vulnerability.Fixed in 2.2.9
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Sylius versions earlier than 1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9 are affected. The issue concerns installations that issue JWTs through separate Admin and Shop API endpoints.
What does an attacker need to exploit this issue?
The attacker needs to register a Shop customer account using an administrator's email address. They can then obtain a Shop API JWT that the Admin API resolves as the administrator.
What access can exploitation provide?
Successful exploitation grants full administrative access through the Admin API. No user interaction is required, but the attacker needs low-privileged access sufficient to register a Shop customer account.
How can the issue be remediated?
Update Sylius to 1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9, as applicable to the deployed release branch.