Cpe:2.3:a:gravitee:gravitee_api_management:*:*:*:*:*:*:*:*

Gravitee API Management versions up to 4.12.22 allow unauthenticated remote attackers to forge JWTs using a default signing secret to impersonate any user, including administrators.