CVE-2021-27884
Weak JSON Web Token in yapi-vendor
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
- Record
CVE-2021-27884- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
CVE List No score
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
- Record
CVE-2021-27884- Updated
- 2026-11-02
EUVDEUVD-2021-0584 No score
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
- Record
EUVD-2021-0584- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2h3h-vw8r-82rp
Weak JSON Web Token in yapi-vendor
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used as a source of randomness in jwt signing. Math.random does not provide cryptographically secure random numbers. This has been patched in version 1.9.3.
- Record
GHSA-2h3h-vw8r-82rp- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
OSV
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
- Record
CVE-2021-27884- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-2h3h-vw8r-82rp
Weak JSON Web Token in yapi-vendor
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used as a source of randomness in jwt signing. Math.random does not provide cryptographically secure random numbers. This has been patched in version 1.9.3.
- Record
GHSA-2h3h-vw8r-82rp- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yapi-vendornpm |
through 1.9.2 | 1.9.3 |
yapi-vendornpm |
before 1.9.3 | 1.9.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-27884 is a medium vulnerability (CVSS 5.1) in Ymfe Yapi, published March 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in yapi-vendor 1.9.3.