Detections
Analytics

CVE-2021-27884

medium

Description

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.

References

https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi

https://github.com/YMFE/yapi/issues/2117

Details

Source: Mitre, NVD

Published: 2021-03-01

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:N

Severity: Low

CVSS v3

Base Score: 5.1

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.00056