Improper Authentication in Ferry JWT Validation

Executive Summary

CVE-2026-127281 is an authentication bypass flaw in the ferry open-source work-order/ITSM platform (versions ≤ v1.0.0). It allows unauthenticated attackers to forge JWT tokens with admin privileges by exploiting weak JWT signing keys, improper key validation, and authorization logic that trusts client-controlled claims. Attackers craft tokens with a hardcoded admin role and expired timestamps, which the server accepts due to weak validation.

Useful 0 Not Useful 0

Detection Guidance

Check if your ferry instance uses a default or empty JWT signing key by inspecting the middleware/auth.go file or configuration. Look for hardcoded 'rolekey': 'admin' claims in JWT tokens. Search for bcrypt password hashes in responses or logs. Use metadata fingerprints like the SPA's <head> content 'FERRY 管理平台' or favicon hash 638540030 to identify vulnerable instances.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables remote attackers to gain full admin access to the ferry system without authentication. Once exploited, attackers can access sensitive data like bcrypt password hashes for all users, which can be cracked offline to recover plaintext passwords (e.g., '123456'). This leads to complete system compromise, including unauthorized data access, modification, or deletion.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance with GDPR and HIPAA due to unauthorized access to sensitive user data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in unauthorized data exposure, leading to legal penalties, fines, and reputational damage for organizations using the affected ferry versions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ferry to a patched version if available. If not, enforce non-empty JWT secrets at startup and remove default keys. Disable or restrict access to sensitive routes until remediation. Rotate all user passwords, especially if bcrypt hashes were exposed. Monitor for unauthorized access attempts or unusual admin activity.

Useful 0 Not Useful 0