CVE-2025-53960
High · 7.5Apache StreamPark: Use the user’s password as the secret key Vulnerability
CVSS
7.5
EPSS
0.3%
Published
Dec 12, 2025
CISA due date
—
The record
When encrypting sensitive data, weak encryption keys that are fixed or directly generated based on user passwords are used. Attackers can obtain these keys through methods such as reverse engineering, code leaks, or password guessing, thereby decrypting stored or transmitted encrypted data, leading to the leakage of sensitive information. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.streampark:streampark | 2.0.0 | 2.1.7 |
| maven | org.apache.streampark/streampark | 2.0.0 | 2.1.7 |
Related vulnerabilities
- GHSA-3hg2-rh4r-8qf6 Apache StreamPark: Use the user’s password as the secret key Vulnerability Same vulnerability
- GHSA-749j-2hp6-8cxm Apache StreamPark uses a Weak Encryption Algorithm Also affects org.apache.streampark:streampark
- GHSA-prv5-c2px-j9q3 Apache StreamPark has a hard-coded encryption key Also affects org.apache.streampark:streampark
- CVE-2025-54947 Apache StreamPark has a hard-coded encryption key Also affects org.apache.streampark:streampark
- CVE-2025-54981 Apache StreamPark uses a Weak Encryption Algorithm Also affects org.apache.streampark:streampark
- CVE-2026-50303 Use of a cryptographic primitive with a risky implementation in Windows Key Guard allows… CWE-1240
- CVE-2026-46654 Plonky3 is a toolkit for polynomial IOPs (PIOPs). CWE-1240
- CVE-2026-44410 This vulnerability stems from a business logic flaw.Attackers can exploit legitimate… CWE-1240