CVE-2022-39366

DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the `StatelessTokenService` of the Metadata service uses the `parse` method of `io.jsonwebtoken.JwtParser`, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm. This issue may lead to an authentication bypass. Version 0.8.45 contains a patch for the issue. There are no known workarounds.

• CWE-287
• CWE-303
• CWE-347

• https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/Third Party Advisory
• https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134Exploit, Third Party Advisory
• https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30Exploit, Third Party Advisory
• https://github.com/datahub-project/datahub/releases/tag/v0.8.45Third Party Advisory
• https://github.com/datahub-project/datahub/security/advisories/GHSA-r8gm-v65f-c973Third Party Advisory
• https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/Third Party Advisory
• https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134Exploit, Third Party Advisory
• https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30Exploit, Third Party Advisory
• https://github.com/datahub-project/datahub/releases/tag/v0.8.45Third Party Advisory
• https://github.com/datahub-project/datahub/security/advisories/GHSA-r8gm-v65f-c973Third Party Advisory

Published

Oct 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3936The Team Members WordPress plugin before 5.2.1 does not sani…4.8
• CVE-2022-39360Metabase is data visualization software. Prior to versions 0…6.5
• CVE-2022-39361Metabase is data visualization software. Prior to versions 0…8.8
• CVE-2022-39362Metabase is data visualization software. Prior to versions 0…8.8
• CVE-2022-39364Nextcloud Server is the file server software for Nextcloud, …6.5
• CVE-2022-39365Pimcore is an open source data and experience management pla…9.8
• CVE-2022-39367QTIWorks is a software suite for standards-based assessment …6.5
• CVE-2022-39368Eclipse Californium is a Java implementation of RFC7252 - Co…8.2
• CVE-2022-39369phpCAS is an authentication library that allows PHP applicat…8
• CVE-2022-3937The Easy Video Player WordPress plugin before 1.2.2.3 does n…5.4
• CVE-2022-39370GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…4.3
• CVE-2022-39371GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…5.4