CVE-2026-100871: Sylius Authentication Bypass Vulnerability

CVE-2026-100871 Overview

CVE-2026-100871 is an authentication bypass vulnerability in Sylius, an open-source e-commerce platform built on Symfony. Affected versions issue JSON Web Tokens (JWTs) that do not include firewall identification, causing audience confusion between the separate Admin and Shop API endpoints. An attacker can register a shop customer account using an administrator's email address, authenticate against the Shop API, and present the resulting token to the Admin API. The Admin API resolves the token to the matching administrator account, granting full administrative access. The flaw is tracked as [CWE-287: Improper Authentication].

Critical Impact

Any unauthenticated attacker who knows an administrator's email address can register a shop account, obtain a JWT, and gain full administrative control of the Sylius store.

Affected Products

• Sylius versions prior to 1.12.25
• Sylius versions 1.13.x prior to 1.13.17, 1.14.x prior to 1.14.20
• Sylius versions 2.1.x prior to 2.1.16, and 2.2.x prior to 2.2.9

Discovery Timeline

• 2026-09-27 - CVE-2026-100871 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100871

Vulnerability Analysis

Sylius exposes two distinct API firewalls: one for shop customers and one for administrators. Both firewalls issue and accept JWTs, but the tokens omit any claim identifying which firewall originally issued them. Token validation relies on resolving the user by email, which creates an identity collision when a shop customer and an administrator share the same email address.

An attacker who knows (or guesses) an administrator's email can self-register a shop customer account using that email through the Shop API registration endpoint. Authenticating against the Shop API returns a valid JWT. When the attacker submits that JWT to the Admin API, the Admin firewall accepts it and resolves the subject to the administrator entity, bypassing authentication entirely.

Root Cause

The root cause is missing audience and principal binding in JWTs issued by Sylius API firewalls. Tokens lacked an aud claim identifying the firewall and did not enforce that the resolved principal match the user type expected by the consuming firewall (ShopUserInterface versus AdminUserInterface). This is a classic JWT audience confusion flaw.

Attack Vector

Exploitation requires only network access to the Sylius storefront registration endpoint and knowledge of a target administrator's email address. The attack requires low privileges (the ability to self-register a customer account) and no user interaction. No prior exploitation has been reported in the wild and no public proof-of-concept is listed.

The upstream fix introduces a JwtAudienceListener and firewall expectation configuration that binds each firewall to its allowed user type:

namespace Sylius\Bundle\ApiBundle\DependencyInjection;

use Sylius\Component\Core\Model\AdminUserInterface;
use Sylius\Component\Core\Model\ShopUserInterface;
use Symfony\Component\Config\Definition\Builder\ArrayNodeDefinition;
use Symfony\Component\Config\Definition\Builder\TreeBuilder;
use Symfony\Component\Config\Definition\ConfigurationInterface;

The extension class wires a new parameter that drives per-firewall JWT expectations:

$container->setParameter('sylius_api.order_states_to_filter_out', $config['order_states_to_filter_out']);
$container->setParameter('sylius_api.operations_to_remove', $config['operations_to_remove']);
$container->setParameter('sylius_api.jwt.firewall_expectations', $config['jwt']['firewall_expectations']);

$loader->load('services.xml');

Source: Sylius Commit cdfb672

Detection Methods for CVE-2026-100871

Indicators of Compromise

• Shop customer registrations whose email addresses match existing administrator accounts in the Sylius user tables.
• Successful Admin API requests immediately preceded by a Shop API /api/v2/shop/authentication-token login from the same client IP or JWT subject.
• Unexpected administrative actions (catalog edits, user role changes, order modifications) performed by accounts recently created through the shop registration flow.

Detection Strategies

• Correlate sylius_shop_user and sylius_admin_user tables for shared email addresses and alert on any match.
• Inspect application and reverse-proxy logs for JWTs issued by the Shop firewall being presented to /api/v2/admin/* endpoints.
• Enable Symfony security event logging to capture authentication provider, firewall name, and resolved user class for every token validation.

Monitoring Recommendations

• Forward Sylius application, web server, and database audit logs to a centralized analytics platform and build detections for cross-firewall token reuse.
• Alert on administrative privilege use by accounts whose first authentication occurred through the shop registration endpoint.
• Monitor for spikes in shop registrations followed quickly by Admin API calls originating from the same session.

How to Mitigate CVE-2026-100871

Immediate Actions Required

• Upgrade Sylius to 1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9 depending on the deployed branch.
• Invalidate all existing JWTs by rotating the JWT signing key and forcing re-authentication for all admin and shop users.
• Audit administrator accounts and the shop customer table for duplicate emails and remove or disable any suspicious shop accounts registered against admin email addresses.

Patch Information

The fix is delivered in Sylius Release v2.2.9 and the equivalent patch releases for the 1.12, 1.13, 1.14, and 2.1 branches. Technical details are documented in GitHub Security Advisory GHSA-f6mx-qxjc-55xf and the VulnCheck Advisory on Sylius JWT. The code change in Sylius Pull Request #19213 adds a JwtAudienceListener that enforces per-firewall audience and principal type validation.

Workarounds

• Restrict Admin API endpoints (/api/v2/admin/*) at the reverse proxy or WAF to trusted source IP ranges or VPN networks until patches can be applied.
• Block shop registrations that use email addresses present in the administrator table using a pre-registration validation hook.
• Enforce separate, non-overlapping email domains for administrators and shop customers as a temporary administrative control.

# Example Composer upgrade for the 2.2 branch
composer require sylius/sylius:^2.2.9 --update-with-dependencies
php bin/console cache:clear --env=prod

# Rotate the Lexik JWT key pair to invalidate outstanding tokens
php bin/console lexik:jwt:generate-keypair --overwrite