Every CVE Search/ Get API key

CVE-2021-37580

Apache ShenYu Admin bypass JWT authentication

9.8 CriticalPublic exploitFix available

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

42.1%Up 41.5 points since Nov 17, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

Record
CVE-2021-37580
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

Apache ShenYu Admin bypass JWT authentication

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

Record
CVE-2021-37580
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2021-2400 No score

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

Record
EUVD-2021-2400
Updated
2026-11-03
GitHub AdvisoriesGHSA-vpfp-5gwq-g533 9.8

Improper Authentication in Apache ShenYu Admin

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0.

Record
GHSA-vpfp-5gwq-g533
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSV 9.8

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

Record
CVE-2021-37580
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-vpfp-5gwq-g533 9.8

Improper Authentication in Apache ShenYu Admin

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0.

Record
GHSA-vpfp-5gwq-g533
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.shenyu:shenyu-admin
Maven
 2.3.0 up to 2.4.1
2.4.1
org.apache.shenyu:shenyu-admin
Maven
 2.3.0 up to 2.4.1, plus listed versions
2.4.0
2.4.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiApache ShenYu Admin JWT - Authentication Bypass
PoC in GitHubCN016/Apache-ShenYu-Admin-JWT-CVE-2021-37580-2023-10-10
PoC in GitHubLiang2580/CVE-2021-375802021-11-19
PoC in GitHubOsyanina/westone-CVE-2021-37580-scanner2021-11-19
PoC in GitHubWing-song/CVE-2021-375802021-11-19
PoC in GitHubZororoZ/CVE-2021-375802021-11-19
PoC in GitHubfengwenhua/CVE-2021-375802021-11-17
PoC in GitHubrabbitsafe/CVE-2021-375802021-11-17

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-37580 is a critical vulnerability (CVSS 9.8) in Apache Shenyu, published November 16, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 42.1%, the 98th percentile. Fixed in org.apache.shenyu:shenyu-admin 2.4.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open