Security · High impactFan score 20 · Tier C
Spring ApplicationContext Hierarchy and a High CVE in Axelix
foojay · By Mikhail Polivakha ·
The Brief
- Axelix has a high-severity CVE involving a JWT bypass.
- The bypass arose when Actuator ran on a separate management port, due to Spring's ApplicationContext hierarchy.
- The source explains how the hierarchy caused the flaw.
Why it matters
Teams running Axelix, or Spring applications with Actuator on a separate management port, may be exposed to a JWT authentication bypass.
Who’s affected
- Teams running Axelix
- Spring applications with Actuator on a separate management port
- #spring
- #security
- #jwt
- #actuator
- #axelix
- #vulnerability
How Spring's ApplicationContext hierarchy caused a JWT bypass in Axelix when Actuator ran on a separate management port.