CyberRota Analysis
AI-GeneratedSylius versions prior to 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable due to the lack of firewall identification in JWT tokens from separate Admin and Shop API endpoints. This flaw allows attackers to exploit an administrator's email to register a shop customer account and receive a token that grants them full administrative access. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.