This vulnerability stems from the use of a shipped default JWT secret in Gravitee API Management. An attacker can forge a JSON Web Token signed with HS256 using this known secret and set the subject to any existing user ID. The resulting bearer token is accepted by the Management API, allowing the attacker to impersonate that user. If the targeted user is an administrator, the attacker achieves unrestricted control over the entire platform, including configuration changes and potential lateral movement. The weakness is grounded in a hard‑coded credential, leading to a severe authentication bypass.

Any installation of Gravitee API Management that relies on the default jwt.secret configuration up to and including version 4.12.22 is affected. The vulnerability is tied to the standard gravitee.yml configuration file and Helm values used in deployments of this product. Users of earlier releases that have not yet upgraded should verify their configuration for this default secret and update accordingly.

The CVSS score of 9.2 indicates critical severity. While EPSS data is not available, the flaw uses a known default secret, making exploitation highly likely for attackers who can query the configuration. The issue is not yet listed in CISA KEV, but it permits unauthenticated remote attackers to compromise the system. The attack path requires only that the attacker know a valid user ID and generate a signed token, which is trivial once the secret is exposed.