---
id: CVE-2020-37281
title: >-
  Gravitee API Management through 4.12.22 contains an authentication bypass
  vulnerability that allows unauthenticated remote attackers to impersonate any
  user by forging JWTs signed with the shipped default jwt.secret
summary: >-
  Gravitee API Management through 4.12.22 contains an authentication bypass
  vulnerability that allows unauthenticated remote attackers to impersonate any
  user by forging JWTs signed with the shipped default jwt.secret. Attackers
  knowing an…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-1394
vendor: Gravitee
product: Gravitee API Management
affected:
  - api_management <= 4.12.22
published: '2026-10-14'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T15:12:54.040'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-37281'
references:
  - url: >-
      https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-management/gravitee-apim-rest-api-management-security/src/main/java/io/gravitee/rest/api/management/security/config/BasicSecurityConfigurerAdapter.java#L157-L175
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-standalone/gravitee-apim-rest-api-standalone-distribution/src/main/resources/config/gravitee.yml#L636-L637
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/helm/values.yaml#L103
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/gravitee-io/gravitee-docs/blob/master/pages/apim/3.x/how-tos/how-to-general-configuration.adoc
    label: disclosure@vulncheck.com
  - url: 'https://github.com/gravitee-io/issues/issues/4204'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/gravitee-api-management-through-4.12.22-default-jwt-secret-authentication-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-14T16:09:27.084463Z'
ingestedAt: '2026-10-14T15:36:13.993Z'
epss: 0.00881
epssPercentile: 0.5895
---

## Overview

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.