CVE-2025-47411: Username Swap in Apache StreamPipes

The core impact of CVE-2025-47411 lies in the potential for unauthorized privilege escalation. An attacker, posing as a regular user, can exploit this vulnerability to assume the identity and permissions of an administrator within the Apache StreamPipes system. This grants them the ability to modify configurations, access sensitive data, and potentially compromise the entire platform. The manipulation of JWT tokens is a key component of this attack, enabling the attacker to impersonate an administrator without proper authentication. The blast radius extends to any data processed or managed by StreamPipes, as an administrator can access and alter it.

1. Reserved2025-05-06
2. Published2026-01-01
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-47411 is to upgrade Apache StreamPipes to version 0.98.0, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Review user account permissions and restrict access to sensitive functionalities. Implement stricter JWT token validation and rotation policies to minimize the impact of token manipulation. Monitor user activity logs for suspicious behavior, particularly any attempts to modify user profiles or access administrative functions. After upgrading to 0.98.0, confirm the fix by attempting a username swap with a non-administrator account; the operation should fail.