Apache SeaTunnel Web Authentication Vulnerability

CVE-2023-48396

What is CVE-2023-48396?

A web authentication vulnerability has been identified in Apache SeaTunnel, wherein a hardcoded JWT key allows attackers to forge tokens and gain unauthorized access to user accounts. The flawed authentication process permits the exploitation of the secret key found within the configuration file located at /seatunnel-server/seatunnel-app/src/main/resources/application.yml. Users are urged to upgrade to Apache SeaTunnel version 1.0.1 to resolve this critical issue and secure their applications from potential token forgery.

References