Apache StreamPark CVE-2025-53960

Exploitation requires the attacker to first obtain a valid JWT issued by Apache StreamPark (versions 2.0.0 up to but not including 2.1.7) - for example by intercepting it in transit, reading it from client storage, or recovering it from logs - because the token itself is the material brute-forced offline. The feasibility of the offline brute-force path is directly LIMITED by password strength: long, high-entropy passwords make HMAC key recovery impractical, while weak or common passwords make it trivial. The alternative forging path requires the attacker to already know the victim's password. There is no required user interaction and no authentication to the StreamPark instance is needed to perform the offline attack, but possession of a captured token (or prior password knowledge) is the hard prerequisite.

This is a moderate, not an emergency, priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N = 5.9 Medium) and the 0.26% EPSS score (16th percentile) are mutually consistent and both point to low likelihood of widespread exploitation. The AC:H rating is well-justified: exploitation is not a single crafted request but depends on first capturing a valid JWT and then successfully cracking the password used as the HMAC key - success is gated on password strength, so a strong-password environment largely neutralizes the offline brute-force path. There is no CISA KEV listing and no public exploit was identified in the provided references, so per the signals this is neither actively exploited nor proven weaponized. One internal tension worth flagging: NVD scores impact as C:H/I:N/A:N (information disclosure only), yet the description explicitly states the outcome is 'complete account takeover,' which logically includes an integrity impact via forged identity tokens - the NVD vector appears to under-count integrity (see assessed vector below). Net: a real design flaw worth patching on a normal cycle, but low real-world urgency absent exposure of JWTs and weak passwords.

An attacker who can observe or capture a StreamPark-issued JWT (e.g., from network traffic, browser storage, logs, or a proxy) takes it offline and brute-forces the HMAC signing key, which is simply the user's password. Once the password is recovered - or if it was already known - the attacker forges arbitrary valid identity tokens for that user, including administrative accounts, achieving full account takeover. No public exploit code was identified at time of analysis, so an attacker would need to build the (straightforward) brute-force tooling themselves.