High severity · published Sep 27, 2026
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sylius · Sylius
1.11.0 before 1.12.25; 1.13.0 before 1.13.17; 1.14.0 before 1.14.20; 2.0.0 before 2.1.16; 2.2.0 before 2.2.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100871
vendor-advisory
https://github.com/Sylius/Sylius/security/advisories/GHSA-f6mx-qxjc-55xf
patch
https://github.com/Sylius/Sylius/pull/19213
patch
https://github.com/Sylius/Sylius/commit/cdfb672a4d174eb2c73159b25cf5b5f44088f45c
release-notes
https://github.com/Sylius/Sylius/releases/tag/v2.2.9
product
https://github.com/Sylius/Sylius
third-party-advisory
https://www.vulncheck.com/advisories/sylius-before-1.12.25-1.13.17-1.14.20-2.1.16-and-2.2.9-jwt-audience-confusion-allows-admin-api-authentication
More from Sylius
8.8
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
8.2
CVE-2022-24743
Sylius is an open source eCommerce platform
7.5
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
7.5
CVE-2024-57610
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account…
6.5
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion of an already-completed order