CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.
| CWE | CWE-287 |
| Vendor | sylius |
| Product | sylius |
| Published | Sep 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for sylius sylius
Be the first to know when new high vulnerabilities affecting sylius sylius are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Sylius / Sylius
1.11.0 < 1.12.25 1.13.0 < 1.13.17 1.14.0 < 1.14.20 2.0.0 < 2.1.16 2.2.0 < 2.2.9
References
github.com: https://github.com/Sylius/Sylius/security/advisories/GHSA-f6mx-qxjc-55xf github.com: https://github.com/Sylius/Sylius/pull/19213 github.com: https://github.com/Sylius/Sylius/commit/cdfb672a4d174eb2c73159b25cf5b5f44088f45c github.com: https://github.com/Sylius/Sylius/releases/tag/v2.2.9 github.com: https://github.com/Sylius/Sylius vulncheck.com: https://www.vulncheck.com/advisories/sylius-before-1.12.25-1.13.17-1.14.20-2.1.16-and-2.2.9-jwt-audience-confusion-allows-admin-api-authentication