CVE-2026-100871— Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
Quick assessment
Affected
Sylius Sylius
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Sylius 1.12.25 之前、1.13.17 之前、1.14.20 之前、2.1.16 之前以及 2.2.9 之前的版本中，由独立的后台管理 API（Admin API）和商店 API（Shop API）端点签发的 JWT 令牌中未包含防火墙（firewall）标识信息。攻击者可以使用管理员的电子邮件地址注册一个商店客户账户，并获取一个令牌，该令牌在后台管理 API 中被解析为该管理员的身份，从而授予攻击者完整的后台管理权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100871
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
Source: CVE Program / CVE List V5
Vulnerability Description
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100871
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100871
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100871 (1)
Vendor Pages for CVE-2026-100871 (1)
Other References for CVE-2026-100871 (4)
-
-
https://github.com/Sylius/Sylius/releases/tag/v2.2.9 release-notes
Same Patch Batch · Sylius · 2026-09-27 · 4 CVEs total
| CVE-2026-100870 | 8.8 HIGH | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning |
| CVE-2026-100872 | 7.5 HIGH | Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite |
| CVE-2026-100869 | 5.9 MEDIUM | Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API |
IV. Related Vulnerabilities
Same product: Sylius
-
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite -
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-100869
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action -
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion o -
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on s
Same vendor: Sylius
-
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite -
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-100869
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action -
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion o -
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on s
Same weakness: CWE-287
-
CVE-2026-52749
Improper Authentication in Kaon AR2140X -
CVE-2026-100886
Seetong T8108/T8108P/T8116/T8232 Debug Service improper auth -
CVE-2026-101050
Heym before 0.0.53 Authentication Bypass via Telegram Webhoo -
CVE-2026-101049
Heym before 0.0.53 Slack Webhook Signature Verification Bypa -
CVE-2026-101042
Parse Server 9.0.0 Authentication Bypass via Unverified Prov
V. Comments for CVE-2026-100871
No comments yet