{"id":"CVE-2023-48396","aliases":["EUVD-2024-2326","GHSA-cp2c-x2pc-fph7"],"status":"published","title":"Apache SeaTunnel Web: Authentication bypass","description":"Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge\nany token to log in any user.\n\nAttacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token.\nThis issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.1, which fixes the issue.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00722,"percentile":0.54268,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2024-07-30T08:15:33Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Maven","package":"org.apache.seatunnel:seatunnel-web","fixed_in":["1.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.seatunnel:seatunnel-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.seatunnel:seatunnel-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]}],"products":[{"vendor":"apache","product":"seatunnel"},{"vendor":"apache software foundation","product":"apache seatunnel web"}],"references":[{"url":"https://lists.apache.org/thread/1tdxfjksx0vb9gtyt77wlr6rdcy1qwmw","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/30/1","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48396","tags":["advisory"]},{"url":"https://github.com/apache/seatunnel-web/commit/4a37ebfa4b57e177bf7857cf39a6dbdc00f75f78","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cp2c-x2pc-fph7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48396.json","tags":["advisory"]},{"url":"https://github.com/apache/seatunnel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-48396","title":"Apache SeaTunnel Web: Authentication bypass","description":"Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge\nany token to log in any user.\n\nAttacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token.\nThis issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.1, which fixes the issue.","status":"published","published":"2024-07-30T08:15:33.731Z","modified":"2025-02-13T17:18:18.107Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:35:25.866071Z"}],"euvd":[{"id":"EUVD-2024-2326","description":"Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge\nany token to log in any user.\n\nAttacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token.\nThis issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.1, which fixes the issue.","status":"published","published":"2024-07-30T08:15:33Z","modified":"2025-02-13T17:18:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T00:03:48.562419Z"}],"ghsa":[{"id":"GHSA-cp2c-x2pc-fph7","title":"Apache SeaTunnel Web Authentication vulnerability","description":"Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user.\n\nAttacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.1, which fixes the issue.","status":"published","published":"2024-07-30T09:32:05Z","modified":"2024-08-09T05:06:56Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:37:59.336921Z"}],"nvd":[{"id":"CVE-2023-48396","description":"Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge\nany token to log in any user.\n\nAttacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token.\nThis issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.1, which fixes the issue.","status":"published","published":"2024-07-30T09:15:02.54Z","modified":"2026-06-17T06:34:10.167Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:09:17.205287Z"}],"osv":[{"id":"CVE-2023-48396","title":"Apache SeaTunnel Web: Authentication bypass","description":"Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge\nany token to log in any user.\n\nAttacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token.\nThis issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.1, which fixes the issue.","status":"published","published":"2024-07-30T08:15:33.731Z","modified":"2026-10-28T02:30:39.402949135Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"GHSA-cp2c-x2pc-fph7","title":"Apache SeaTunnel Web Authentication vulnerability","description":"Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user.\n\nAttacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.1, which fixes the issue.","status":"published","published":"2024-07-30T09:32:05Z","modified":"2024-07-30T17:11:53.12565Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"},{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:46:45.28161Z"}]}}