Status: Patched

This vulnerability has been verified as resolved and deployed.

SyliusHigh2026-09-02

Shop JWT identifier collision enables admin API takeover

Summary

Shop and admin firewalls accepted JWTs from one signing domain without audience or principal binding

An ordinary customer could change their shop email to collide with an API administrator's identifier, obtain a normal shop JWT, and replay it to the admin API. The admin firewall reloaded the identifier through the administrator repository and granted the victim administrator's API role.

Root cause. The shop and admin API firewalls trusted the same Lexik JWT signing configuration, while the token lacked a firewall audience or principal-class claim. A writable customer email became the shop username, allowing a cross-repository identifier collision.

Remediation evidence. Sylius confirmed the report, published GHSA-f6mx-qxjc-55xf with an explicit Winfunc Research credit, and shipped patched releases 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9.

CVSS Score

VectorN

ComplexityL

PrivilegesL

User InteractionN

ScopeU

ConfidentialityH

IntegrityH

AvailabilityH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Location

SourceLine 24

src/Sylius/Bundle/ApiBundle/Resources/config/serialization/Customer.xml

Customer.email

SinkLine 58

config/packages/security.yaml

security.firewalls.api_admin

Source-to-Sink Analysis

src/Sylius/Bundle/ApiBundle/Resources/config/api_platform/resources/shop/Customer.xml:66

A shop customer updates only their own email to the known identifier of an enabled API administrator.

PYTHON

PUT /api/v2/shop/customers/{own-id}
{ "email": "admin@example.test" }

src/Sylius/Bundle/UserBundle/EventListener/ORM/DefaultUsernameORMListener.php

Normal persistence synchronizes the chosen customer email into the shop user's canonical username.

PYTHON

$user->setUsername($customer->getEmail());

config/packages/security.yaml:58

The admin firewall accepts the shop-issued signature and resolves the colliding identifier as the existing AdminUser.

PYTHON

api_admin:
  provider: sylius_admin_user_provider
  jwt: ~

Impact Analysis

Critical Impact

The collision crosses the customer/admin trust boundary and grants the administrator's API authority, enabling access to cross-customer commerce data and state-changing administrative operations exposed by the deployment.

Attack Surface

Sylius installations exposing both shop and admin APIs with JWT authentication on affected releases.

Preconditions

The attacker needs an ordinary shop account whose email can be changed and the email address of an enabled administrator with API access. No administrator password, signing key, or victim token is needed.

Proof of Concept

Environment Setup

Run an affected Sylius API build in an isolated store with one ordinary customer and one enabled API administrator.

Target Configuration

Ensure both shop and admin JWT firewalls use the affected shared trust configuration and the administrator has ROLE_API_ACCESS.

Exploit Delivery

Update the customer's own email to the administrator identifier, obtain a fresh shop token, and send it as a bearer token to an admin collection such as /api/v2/admin/shipments.

Outcome

Patched releases bind tokens to the intended security context, so a shop token cannot authenticate as an AdminUser even when identifiers collide.

Expected Response: The vulnerable release returns administrator-only data instead of rejecting the shop token.

Run this level of analysis on your repo.

Winfunc traces source-to-sink paths, validates exploitability, and gives your team patch-ready remediation.

Vulnerability Detection

View Patch PRVerify fix on GitHub