CVE-2025-47411

Name: CVE-2025-47411
Creator: NVD / NIST
Published: 2026-01-01T17:15:42.943+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.1/10EPSS 14.79%

Last modified Jun 17, 2026

CVE-2025-47411 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues. This issue affects Apache StreamPipes: through 0.97.0. Users are recommended to upgrade to version 0.98.0, which fixes the issue.. EPSS estimates a 14.79% chance of exploitation in the next 30 days.

Description

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues. This issue affects Apache StreamPipes: through 0.97.0. Users are recommended to upgrade to version 0.98.0, which fixes the issue.

Metrics

CVSS 3.1

8.1/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Probability

14.79%

96.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-269

Affected Software

Vendor	Product	Versions
Apache	Streampipes	>= 0.69.0, < 0.98.0

References

https://lists.apache.org/thread/lngko4ht2ok3o0rk9h0clgm4kb0lmt36Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/29/14Mailing List, Third Party Advisory

Timeline

Published: Jan 1, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-47411?

How severe is CVE-2025-47411?

CVE-2025-47411 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 14.79% probability of exploitation in the next 30 days.

How do I fix CVE-2025-47411?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-47411?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST