{"id":"CVE-2026-127281","kind":"vulnerability","aliases":["CVE-2026-127281"],"related":[],"title":"Ferry: forged JWT (empty or default secret) gives admin access; no fix","description":"A vulnerability was found in lanyulei ferry 1.0.0-beta.1/1.0.0. Affected is an unknown function of the file middleware/auth.go of the component JWT Validation. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Ferry (lanyulei/ferry) 1.0.0 and 1.0.0-beta.1 accept forged JWTs. The reporter says that when settings.jwt.secret is unset the secret is an empty string the middleware does not reject, and the default config ships jwt.secret: ferry. The permission middleware also trusts the token's rolekey claim without checking the database, so a forged token with rolekey admin gives admin rights. VulDB reports a public PoC and no vendor response; the GitHub issue (#343) is still open with no maintainer reply.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ferry","fixed":[],"affected":"1.0.0-beta.1, 1.0.0","ecosystem":"go"}],"ecosystems":[],"tags":["auth-bypass","ferry","go","jwt","other","self-hosted"],"not_affected_if":["custom-jwt-secret","not-internet-exposed","other-versions"],"how_to_check":"Check whether you run Ferry 1.0.0 or 1.0.0-beta.1. In your config (settings.yml) look at settings.jwt.secret: if it is empty or 'ferry' (the shipped default), you are exposed. Also check middleware/permission.go for a subject taken straight from the token's rolekey claim.","fix":"unknown: no patched version found; the maintainer has not answered issue #343 or VulDB. Workaround: set a long random settings.jwt.secret (and restart, which invalidates old tokens), and do not expose Ferry to the internet.","status":"open","published_at":"2026-11-13T02:18:55+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","triaged_at":"2026-11-13T02:42:59+00:00","updated_at":"2026-11-13T02:46:30+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T02:42:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ferry: JWT validation flaw in auth middleware allows improper authentication","impact":"high","summary":"Ferry, an open-source project by lanyulei, has a flaw in the JWT validation code of middleware/auth.go in versions 1.0.0-beta.1 and 1.0.0. A remote attacker can exploit it to get past authentication, and a public exploit exists.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ferry","self-hosted","jwt"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker bypasses authentication and reaches protected application functions","analyst_note":"Confirm the fixed version and whether a patch exists at the Ferry repository or NVD entry; the sources give no fix.","how_to_check":"- Check whether the deployed Ferry version is `1.0.0-beta.1` or `1.0.0`\n- Look at `middleware/auth.go` in your Ferry source for the JWT validation logic\n- unknown for anything beyond this","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Teams that run lanyulei Ferry 1.0.0-beta.1 or 1.0.0 with its JWT-based auth middleware exposed to a network. The sources do not say whether a default configuration is affected or whether other versions are safe. Deployments that do not run these versions can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4575,"output_tokens":552,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists at the Ferry repository or NVD entry; the sources give no fix.","search":"'-127281':15A,18A '-2026':14A,17A '1.0.0':32B,34B,116C '343':101B 'accept':36B 'access':10A 'admin':9A,85B,87B 'affect':118C 'also':68B 'attack':139C 'auth':21B 'auth-bypass':20B 'authent':137C 'beta.1':35B 'beta.1/1.0.0':117C 'bypass':22B 'check':76B 'claim':74B 'compon':129C 'config':61B 'contact':157C 'could':151C 'cve':13A,16A 'databas':78B 'default':6A,60B 'disclosur':161C 'earli':158C 'empti':4A,51B 'execut':142C 'exploit':145C 'ferri':1A,23B,30B,64B,115C 'ferry':19A 'file':125C 'fix':12A 'forg':2A,37B,81B 'found':112C 'function':122C 'github':99B 'give':8A,86B 'go':24B 'host':29B 'improp':136C 'issu':100B 'jwt':3A,25B,130C 'jwt.secret':63B 'jwts':38B 'lanyulei':114C 'lanyulei/ferry':31B 'made':148C 'maintain':107B 'manipul':133C 'middlewar':54B,67B 'middleware/auth.go':126C 'open':104B 'permiss':66B 'poc':93B 'public':92B,149C 'reject':57B 'remot':143C 'repli':108B 'report':40B,90B 'respond':165C 'respons':97B 'result':134C 'right':88B 'rolekey':73B,84B 'say':41B 'secret':7A,48B 'self':28B 'self-host':27B 'settings.jwt.secret':44B 'ship':62B 'still':103B 'string':52B 'token':71B,82B 'trust':69B 'unknown':121C 'unset':46B 'use':153C 'valid':131C 'vendor':96B,155C 'vuldb':89B 'vulner':110C 'way':168C 'without':75B","nicknames":[],"mitigations":[],"who_affected":"Teams that run lanyulei Ferry 1.0.0-beta.1 or 1.0.0 with its JWT-based auth middleware exposed to a network. The sources do not say whether a default configuration is affected or whether other versions are safe. Deployments that do not run these versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ferry"],"ptokens":["ferry"],"labels":["authbypass","ferry","go","high","jwt","other","selfhosted"],"campaign_type":null,"search_a":"'-127281':15A,18A '-2026':14A,17A 'access':10A 'admin':9A 'cve':13A,16A 'default':6A 'empti':4A 'ferri':1A 'ferry':19A 'fix':12A 'forg':2A 'give':8A 'jwt':3A 'secret':7A","search_b":"'1.0.0':32B,34B '343':101B 'accept':36B 'admin':85B,87B 'also':68B 'auth':21B 'auth-bypass':20B 'beta.1':35B 'bypass':22B 'check':76B 'claim':74B 'config':61B 'databas':78B 'default':60B 'empti':51B 'ferri':23B,30B,64B 'forg':37B,81B 'github':99B 'give':86B 'go':24B 'host':29B 'issu':100B 'jwt':25B 'jwt.secret':63B 'jwts':38B 'lanyulei/ferry':31B 'maintain':107B 'middlewar':54B,67B 'open':104B 'permiss':66B 'poc':93B 'public':92B 'reject':57B 'repli':108B 'report':40B,90B 'respons':97B 'right':88B 'rolekey':73B,84B 'say':41B 'secret':48B 'self':28B 'self-host':27B 'settings.jwt.secret':44B 'ship':62B 'still':103B 'string':52B 'token':71B,82B 'trust':69B 'unset':46B 'vendor':96B 'vuldb':89B 'without':75B","search_c":"'1.0.0':116C 'affect':118C 'attack':139C 'authent':137C 'beta.1/1.0.0':117C 'compon':129C 'contact':157C 'could':151C 'disclosur':161C 'earli':158C 'execut':142C 'exploit':145C 'ferri':115C 'file':125C 'found':112C 'function':122C 'improp':136C 'jwt':130C 'lanyulei':114C 'made':148C 'manipul':133C 'middleware/auth.go':126C 'public':149C 'remot':143C 'respond':165C 'result':134C 'unknown':121C 'use':153C 'valid':131C 'vendor':155C 'vulner':110C 'way':168C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127281","severity":null,"published_at":"2026-11-13T02:18:55+00:00","modified_at":"2026-11-13T02:18:55+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","fetched_at":"2026-11-13T02:41:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127281:3807","url":"https://github.com/lanyulei/ferry/issues/343","severity":null,"published_at":"2026-11-13T02:46:30+00:00","modified_at":"2026-11-13T02:46:30+00:00","first_seen_at":"2026-11-13T02:46:30+00:00","fetched_at":"2026-11-13T02:46:30+00:00","note":"Read reporter issue #343 and VulDB; no maintainer fix or advisory found; fix-status none not verified from vendor page so left unmarked; NVD page returned empty.","cites":["https://github.com/lanyulei/ferry/issues/343","https://vuldb.com/vuln/436447"]}],"documents":[{"id":142072,"url":"https://github.com/lanyulei/ferry/issues/343","title":"Ferry #343: JWT empty secret and trusted rolekey claim allow auth bypass","kind":"issue","source":"analyst","publisher":null,"text":"Reporter liumiya63-arch, opened 2026-10-18, still open. If settings.jwt.secret is unset viper returns an empty string; the check 'mw.Key == nil' does not catch []byte(\"\"). Default config also hardcodes jwt.secret: ferry. middleware/permission.go (Casbin) takes the subject from the token rolekey claim with no database check, so a forged token with rolekey admin gives admin rights.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":142073,"url":"https://vuldb.com/vuln/436447","title":"VDB-436447 lanyulei ferry JWT Validation improper authentication","kind":"advisory","source":"analyst","publisher":null,"text":"VulDB: ferry 1.0.0 and 1.0.0-beta.1, middleware/auth.go, CWE-287, remote, no authentication needed, public PoC. Vendor contacted early, no response. No countermeasure known. Disclosed 2026-11-12. Submission title: 'JWT Empty Secret Authentication Bypass'.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}