CVE-2026-100871GHSA-f6mx-qxjc-55xf
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
Sylius Sylius
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.12.25SyliusCVE List
- 1.13.17SyliusCVE List
- 1.14.20SyliusCVE List
- 2.1.16SyliusCVE List
- 2.2.9SyliusCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.
Text from CVE List
Affected versions 5
- Syliusaffected: 1.11.0 before 1.12.25CVE List
- Syliusaffected: 1.13.0 before 1.13.17CVE List
- Syliusaffected: 1.14.0 before 1.14.20CVE List
- Syliusaffected: 2.0.0 before 2.1.16CVE List
- Syliusaffected: 2.2.0 before 2.2.9CVE List
References 6
- github.com/Sylius/Sylius/pull/19213Fixvia CVE List
- github.com/Sylius/Sylius/commit/cdfb672a4d174eb2c73159b25cf5b5f44088f45cFixvia CVE List
- github.com/Sylius/Sylius/releases/tag/v2.2.9Fixvia CVE List
- github.com/Sylius/Sylius/security/advisories/GHSA-f6mx-qxjc-55xfAdvisoryvia CVE List
- vulncheck.com/advisories/sylius-before-1.12.25-1.13.17-1.14.20-2.1.16-and-2.2.9-jwt-audience-confusion-allows-admin-api-authenticationAdvisoryvia CVE List
- github.com/Sylius/SyliusReferencevia CVE List