Improper Authentication in Apache ShenYu Admin

CRITICAL 9.8CVE-2021-37580 · GHSA-vpfp-5gwq-g533 · Published 16/11/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.shenyu:shenyu-admin Maven	`≥ 2.3.0, < 2.4.1`	`2.4.1`
shenyu apache	`= 2.3.0= 2.4.0`	No fix yet

Description

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0.

NVD description

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

References

nvd.nist.gov/vuln/detail/CVE-2021-37580 · ADVISORY
apache/shenyu commit f78adb2 · WEB
apache/shenyu · PACKAGE
apache/shenyu release v2.4.1 · WEB
lists.apache.org/thread/o15j25qwtpcw62k48xw1tnv48skh3zgb · WEB
openwall.com/lists/oss-security/2021/11/16/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free