JWT Audience Confusion in Sylius Affects Administrative Access

CVE-2026-100871

What is CVE-2026-100871?

A significant security flaw exists in the Sylius platform where selected versions fail to properly segregate firewall identification in the JSON Web Tokens (JWT) issued for Admin and Shop API endpoints. This oversight allows malicious users to create shop customer accounts using an administrator's email address. By doing so, they can obtain a JWT that the Admin API treats as valid for the administrator account, thereby granting them unauthorized and full administrative access. To mitigate this issue, upgrades to at least versions 1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9 are strongly advised.

References