---
id: CVE-2020-37281
title: >-
  Gravitee API Management through 4.12.22 contains an authentication bypass
  vulnerability that allows unauthenticated remote attackers to impersonate any
  user by forging JWTs signed with the shipped default jwt.secret
summary: >-
  Gravitee API Management through 4.12.22 contains an authentication bypass
  vulnerability that allows unauthenticated remote attackers to impersonate any
  user by forging JWTs signed with the shipped default jwt.secret. Attackers
  knowing an…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-1394
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:17:34.023'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-37281'
references:
  - url: >-
      https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-management/gravitee-apim-rest-api-management-security/src/main/java/io/gravitee/rest/api/management/security/config/BasicSecurityConfigurerAdapter.java#L157-L175
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-standalone/gravitee-apim-rest-api-standalone-distribution/src/main/resources/config/gravitee.yml#L636-L637
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/helm/values.yaml#L103
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/gravitee-io/gravitee-docs/blob/master/pages/apim/3.x/how-tos/how-to-general-configuration.adoc
    label: disclosure@vulncheck.com
  - url: 'https://github.com/gravitee-io/issues/issues/4204'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/gravitee-api-management-through-4.12.22-default-jwt-secret-authentication-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:13.993Z'
---

## Overview

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.