CVE-2025-47411: Critical Apache StreamPipes Flaw Allows Standard Users to Seize Admin Control

CVE-2025-47411 is a newly disclosed, critical flaw in Apache StreamPipes that lets standard users seize total administrative control. The vulnerability, rated as Important, affects StreamPipes installations from versions 0.69.0 through 0.97.0. It exploits a logic error in how user identities are created and verified, allowing a legitimate non-administrator to perform a digital sleight of hand by manipulating JWT tokens.

According to disclosure, an attacker can swap the username of an existing user with that of an administrator, enabling privilege escalation and potential data tampering or unauthorized access. The development team has released a fix, and users running affected versions are recommended to upgrade to version 0.98.0, which closes the issue. Organizations relying on StreamPipes for IIoT should prioritise this update to prevent misuse by non-technical users or insider threats.