CVE-2025-47411
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-01

Last updated on: 2026-01-06

Assigner: Apache Software Foundation

Description
A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator.  This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues. This issue affects Apache StreamPipes: through 0.97.0. Users are recommended to upgrade to version 0.98.0, which fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-01
Last Modified
2026-01-06
Generated
2026-06-16
AI Q&A
2026-01-01
EPSS Evaluated
2026-06-15
NVD
CVE-2025-47411
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache streampipes From 0.69.0 (inc) to 0.98.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Apache StreamPipes allows a legitimate non-administrator user to exploit a flaw in the user ID creation mechanism to swap their username with that of an administrator. By manipulating JSON Web Tokens (JWT), the attacker can gain administrative privileges within the application. [2]

Impact Analysis

The vulnerability can lead to unauthorized elevation of privileges, allowing attackers to gain administrative control. This can result in data tampering, unauthorized access to sensitive information, and other significant security risks within the application. [2]

Mitigation Strategies

Users are strongly advised to upgrade Apache StreamPipes to version 0.98.0, which fixes the vulnerability. This upgrade will prevent the privilege escalation caused by the user ID creation mechanism flaw. [2]

Compliance Impact

This vulnerability allows unauthorized users to gain administrative control, potentially leading to data tampering and unauthorized access. Such security breaches can result in non-compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data. Therefore, exploitation of this vulnerability could compromise compliance with these regulations. [2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-47411. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart