External risk intelligence

Gravitee API Management Default JWT Secret Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2020-37281

The vulnerability affects Gravitee API Management, which is typically deployed as an internet-facing gateway or management service to handle API traffic. Because this product is designed to sit at the network edge to manage, secure, and route APIs, its management interfaces and endpoints are commonly reachable via the public internet in standard deployment patterns.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Gravitee API Management could allow unauthorized individuals to bypass authentication controls, potentially impersonating legitimate users, including administrators, to gain full control over the platform. The issue arises from the use of a default secret for signing JSON Web Tokens (JWTs), which attackers can exploit to forge valid tokens.

Bypass authentication using default secrets.
Allows impersonation of any user, including administrators.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could impersonate any user, including administrators, by forging a JSON Web Token (JWT) signed with the product's default secret. This allows them to gain full control of the platform by bypassing authentication.

Unauthenticated remote access required.
Forged JWT signed with default secret.
Full platform control via impersonation.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authentication bypass vulnerability in Gravitee API Management could allow an unauthenticated remote attacker to impersonate users, including administrators, by forging JWTs signed with a default secret. This could lead to full platform control.

User and administrator accounts at risk.
Forged JWTs could grant unauthorized access.
Full platform control may be achieved.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determine ownership of Gravitee API Management and its associated components, confirm its exposure and criticality, and plan remediation based on the identified risks. This vulnerability allows unauthenticated remote attackers to impersonate users by forging JWTs signed with the default secret, granting them full platform control.

Cloud Platform or Infrastructure teams own this.
Verify external reachability and asset criticality.
Plan remediation or implement temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Gravitee API Management?

Gravitee API Management is a software platform used to secure, publish, and analyze APIs. It acts as an intermediary or gateway between client applications and backend services, controlling how data flows and who can access specific resources. Organizations deploy it to manage the lifecycle of their APIs, ensuring that traffic is properly routed and protected.

What does CVE-2020-37281 mean in plain English?

This vulnerability is an authentication bypass, classified as CWE-1394. It stems from the software using a pre-configured, default secret key to sign JSON Web Tokens (JWTs). Because this secret is standard across installations, an attacker can use it to create their own valid-looking tokens. By presenting these forged tokens, an attacker tricks the system into believing they are a legitimate, authorized user or administrator.

How does an attacker trigger this vulnerability?

An attacker triggers this by generating a JWT with their own choice of user ID and signing it using the known default secret key. They then provide this forged token to the Management API as a bearer token. Note that simply knowing the API exists is not enough; the attacker must be able to reach the authentication endpoint and successfully use the default secret to craft a token the system will trust.

Is my Gravitee instance at risk?

According to Halo Surface Signal, this software is often deployed as an internet-facing gateway, making its management interfaces reachable from the public web. If your instance is exposed to the internet, it is at higher risk of being reached by an unauthenticated attacker. Even internal instances should be reviewed to ensure the default configuration has been replaced with a secure, custom secret.

What is the first step to address CVE-2020-37281?

The immediate priority is to identify where your organization uses Gravitee API Management and determine if the default JWT secret is still in place. Coordinate with your infrastructure or platform teams to confirm the deployment status. If the default secret is active, you must update the configuration to use a strong, unique, and private secret to prevent unauthorized token generation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.