Apache StreamPark Flaw Risks Data Decryption & Token Forgery via Hard-Coded Key and AES ECB Mode

The Apache StreamPark vulnerability report highlights a cryptographic hygiene failure that could allow token forgery and data decryption due to hard-coded keys and the use of AES in ECB mode. The flaws affect versions 2.0.0 through 2.1.7, with administrators urged to upgrade to version 2.1.7 to secure deployments.

The advisory identifies CVE-2025-54947, describing the fixed, immutable key baked into the software, and CVE-2025-54981, noting the insecure ECB mode and a weak random number generator used for encrypting sensitive data, including JWT tokens. According to the source, attackers may obtain the master key via reverse engineering or code analysis, potentially decrypting data or forging encrypted information.

The combination of a hard-coded key, ECB encryption, and weak randomness undermines authentication mechanisms and could have broad ripple effects across cloud environments relying on the framework. The article stresses the need to apply the upgrade promptly to mitigate these risks.