CVE-2025-54981
High · 7.5Apache StreamPark uses a Weak Encryption Algorithm
CVSS
7.5
EPSS
0.2%
Published
Dec 12, 2025
CISA due date
—
The record
Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing sensitive authentication data This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.streampark:streampark | 2.0.0 | 2.1.7 |
| maven | org.apache.streampark/streampark | 2.0.0 | 2.1.7 |
Related vulnerabilities
- GHSA-749j-2hp6-8cxm Apache StreamPark uses a Weak Encryption Algorithm Same vulnerability
- GHSA-3hg2-rh4r-8qf6 Apache StreamPark: Use the user’s password as the secret key Vulnerability Also affects org.apache.streampark:streampark
- GHSA-prv5-c2px-j9q3 Apache StreamPark has a hard-coded encryption key Also affects org.apache.streampark:streampark
- CVE-2025-54947 Apache StreamPark has a hard-coded encryption key Also affects org.apache.streampark:streampark
- CVE-2025-53960 Apache StreamPark: Use the user’s password as the secret key Vulnerability Also affects org.apache.streampark:streampark
- CVE-2026-81822 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards… CWE-327
- CVE-2026-16693 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain… CWE-327
- CVE-2026-81859 CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive… CWE-327