AIKIDO-2026-794271

sylius/sylius is vulnerable to Authentication Bypass

Authentication BypassGHSA-f6mx-qxjc-55xf Published 4 days ago

High Risk

This Affects:

sylius/sylius

1.11.0 - 1.12.24

Fixed in 1.12.25

1.13.0 - 1.13.16

Fixed in 1.13.17

1.14.0 - 1.14.19

Fixed in 1.14.20

2.0.0 - 2.1.15

Fixed in 2.1.16

2.2.0 - 2.2.8

Fixed in 2.2.9

Are you affected? Scan for Free

TL;DR

The Sylius API issues JWTs from separate admin and shop firewalls, but the tokens carry no claim identifying which firewall issued them. Because both firewalls resolve the authenticated user by email across separate user tables, a shop customer whose email matches an administrator can present a shop-issued token to the admin API and be authenticated as that administrator. This grants full administrative access and needs only knowledge of an administrator email address. The fix adds a JwtAudienceListener that stamps an audience and principal claim on issued tokens and verifies both on every request.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you expose the Sylius API with JWT authentication on both the admin and shop firewalls.

Background info

sylius/sylius is vulnerable to Authentication Bypass in versions 1.11.0 - 1.12.24, 1.13.0 - 1.13.16, 1.14.0 - 1.14.19, 2.0.0 - 2.1.15 and 2.2.0 - 2.2.8.