Advisory · CVE-2026-100871
Sylius JWT confusion let shop users authenticate as administrators
Sylius issued Admin and Shop API JWTs without firewall identification, so a token from a shop account registered with an admin email was accepted by the Admin API.
- Vendor
- Sylius
- Product
- Sylius
- Identifier / CWE
- CVE-2026-100871
CWE-287 - Action timing
- Immediate
Explain it like I’m five
Sylius ran two clubs, the shop and the admin office, and issued the same badge for both. A visitor registered at the shop using an admin's name, and the admin office's guard, seeing a familiar name on a real badge, let them straight in.
- 01Shared token format
The Admin and Shop API endpoints issued JWT tokens without identifying which firewall, or audience, the token belonged to.
- 02Admin email registered
An attacker registers an ordinary shop customer account using an administrator's email address.
- 03Token obtained
The shop API issues a valid JWT for that customer account.
- 04Admin API accepts it
Presented to the Admin API, the token resolves to the administrator account, granting full administrative access.
What happened
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 failed to include firewall identification in JWT tokens issued by the separate Admin and Shop API endpoints. An attacker could register a shop customer account using an administrator’s email address and obtain a token that the Admin API resolved to that administrator, granting full administrative access.
The flaw is fixed in Sylius 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9, which identify the issuing firewall in the tokens.
What to do
- Upgrade Sylius to a fixed release on your branch (1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9).
- Review shop registrations for customer accounts using administrator email addresses, especially ones created recently.
- Audit Admin API access logs for tokens issued to shop firewalls being used against admin endpoints.
- Rotate administrator credentials and review admin-side actions taken during the exposure window.
Management note
This one needs no victim interaction and no sophisticated tooling: registration plus an email address was enough. The upgrade is the fix, but the registration review is the part that tells you whether anyone already walked through the open door.