CVE-2025-47411HIGH 8.1EPSS p96.3%

CVE-2025-47411CVE-2025-47411

Description

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator.  This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues. This issue affects Apache StreamPipes: through 0.97.0. Users are recommended to upgrade to version 0.98.0, which fixes the issue.

Scoring

CVSS 3.18.1 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS14.79% probability of exploitation · percentile 96.3% · 2026-06-19T12:03:05Z
Published2026-01-01
Last modified2026-01-06

Underlying weaknesses· 1

CWE-269

References

  1. https://lists.apache.org/thread/lngko4ht2ok3o0rk9h0clgm4kb0lmt36
  2. http://www.openwall.com/lists/oss-security/2025/12/29/14

1

TypeTargetConfidenceTier
WeaknessImproper Privilege Managementcwe-2690%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-36418
CVE
CVE-2025-10611
CVE
CVE-2025-7722
CVE
CVE-2025-51606
CVE
CVE-2025-41115
CVE
CVE-2025-54947
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.