CVE-2021-27884

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/YMFE/yapi/issues/2117Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapiThird Party Advisory
https://github.com/YMFE/yapi/issues/2117Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapiThird Party Advisory

Timeline

Published: Mar 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-278858.8usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.CVE-2021-278869.8rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command CVE-2021-278875.4Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated applicatio CVE-2021-278886.1ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.CVE-2021-278896.1Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.CVE-2021-278908.8SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.CVE-2021-278918.8SSH Tectia Client and Server before 6.4.19 on Windows have weak key generation. ConnectSecure on Windows is affected.CVE-2021-278927.8SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation. ConnectSecure on Windows is affected.CVE-2021-278937.0SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation in nonstandard conditions. ConnectSecure on Windows i CVE-2021-278997.4The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server CVE-2021-279008.1The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Co CVE-2021-279016.8An issue was discovered on LG mobile devices with Android OS 11 software. They mishandle fingerprint recognition because local high beam mod