{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agraviteegravitee_api_management/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gravitee:gravitee_api_management:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2020-37281"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gravitee API Management (\u003c= 4.12.22)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Gravitee"],"content_html":"\u003cp\u003eGravitee API Management (APIM) versions through 4.12.22 contain a critical authentication bypass vulnerability stemming from the use of a hardcoded or default secret key used for HS256 JWT signing. Remote, unauthenticated attackers can leverage this known default secret to sign arbitrary JSON Web Tokens (JWTs). By supplying a valid user ID - such as an administrator account - within the subject ('sub') claim of the forged token, an attacker can successfully authenticate to the Management API. This bypass grants the attacker full control over the API management platform, including the ability to modify API configurations, view sensitive data, and manage underlying services. Defenders should verify that their deployments have moved away from default configuration secrets immediately, as this vulnerability requires no specialized knowledge beyond the publicly identified default value.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in total compromise of the Gravitee API Management platform. An attacker with administrative access can exfiltrate sensitive data, manipulate API traffic, and potentially gain access to downstream systems connected through the gateway. Any organization utilizing default installation configurations for Gravitee APIM within the affected version range is at high risk of unauthorized administrative access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Gravitee API Management to the latest patched version immediately.\u003c/li\u003e\n\u003cli\u003eAudit all production configurations to ensure that 'jwt.secret' values are cryptographically secure and rotated from any default values provided during installation.\u003c/li\u003e\n\u003cli\u003eReview Management API access logs for anomalous Bearer token patterns, specifically looking for tokens that bypass standard identity provider handshakes.\u003c/li\u003e\n\u003cli\u003eImplement strict firewall controls around the Management API to limit access to known, trusted administrative subnets.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:36:08Z","date_published":"2026-10-14T16:36:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gravitee-auth-bypass/","summary":"Gravitee API Management versions up to 4.12.22 allow unauthenticated remote attackers to forge JWTs using a default signing secret to impersonate any user, including administrators.","title":"Gravitee API Management Authentication Bypass via Default JWT Secret","url":"https://feed.craftedsignal.io/briefs/2026-10-gravitee-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:gravitee:gravitee_api_management:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}