Gravitee API Management: Authentication bypass via forged JWTs with default secret

Summary

Gravitee API Management through 4.12.22 ships with a default jwt.secret. An unauthenticated remote attacker who knows an existing user ID can sign a JWT with this secret and use it as a bearer token against the Management API. This allows impersonation of administrators and full control of the platform.

Affected

• Gravitee API Management 0 through 4.12.22 (default configuration with the shipped jwt.secret)

Fixed in

• Unknown. No fixed version was confirmed in the sources reviewed.

Workaround

• Replace the default jwt.secret with a unique, long random value and restart the service.
• Restrict access to the Management API to administrative networks or a VPN.

Exploitation

• Attack requires only network access to the Management API and knowledge of an existing user ID; no prior authentication is needed.
• Known exploitation in the wild: Unknown. No public proof of concept was found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Identify all Gravitee API Management instances and their versions.
• Check whether jwt.secret is still the shipped default; if so, replace it immediately and restart.
• Restrict Management API access to admin networks.
• Check the Gravitee advisories and release notes for a fixed version and upgrade once available.
• Monitor for unexpected administrator activity and re-check exploitation status before closing this item.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Gravitee gravitee.yml at 4.12.22 github.com
• Gravitee BasicSecurityConfigurerAdapter.java at 4.12.22 github.com
• Gravitee issue #4204 github.com
• Gravitee production best practices: authentication documentation.gravitee.io
• VulDB entry 419898 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:37.