Replayable JWT Token Vulnerability in Apache Ranger by Apache

CVE-2026-65945

What is CVE-2026-65945?

In Apache Ranger versions 2.8.0 and earlier, the logging mechanism improperly handles JSON Web Tokens (JWTs), allowing replayable tokens to be recorded in logs. This raises serious security concerns, as unauthorized parties may exploit these replayable tokens to gain unauthorized access or perform actions on behalf of legitimate users. Users are encouraged to update to version 2.9.0 or later to mitigate this risk and enhance security measures.

References