{"id":"PYSEC-2026-252","summary":"acryl-datahub missing JWT signature check","details":"# Missing JWT signature check (`GHSL-2022-078`)\n\nThe [`StatelessTokenService`](https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30) of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the `StatelessTokenService` of the Metadata service uses the [`parse`](https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134) method of `io.jsonwebtoken.JwtParser`, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm.\n\n#### Impact\n\nThis issue may lead to an authentication bypass.\n\n#### Resources\n\n* [CodeQL: Missing JWT signature check](https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/)","aliases":["CVE-2022-39366","GHSA-r8gm-v65f-c973"],"modified":"2026-07-01T20:22:47.545360Z","published":"2026-06-29T11:50:33.490689Z","references":[{"type":"WEB","url":"https://github.com/datahub-project/datahub/security/advisories/GHSA-r8gm-v65f-c973"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39366"},{"type":"WEB","url":"https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check"},{"type":"PACKAGE","url":"https://github.com/datahub-project/datahub"},{"type":"WEB","url":"https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134"},{"type":"WEB","url":"https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30"},{"type":"WEB","url":"https://github.com/datahub-project/datahub/releases/tag/v0.8.45"},{"type":"PACKAGE","url":"https://pypi.org/project/acryl-datahub"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r8gm-v65f-c973"}],"affected":[{"package":{"name":"acryl-datahub","ecosystem":"PyPI","purl":"pkg:pypi/acryl-datahub"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.45"}]}],"versions":["0.0.2","0.0.3","0.0.4","0.0.5","0.1.0","0.1.1","0.1.2","0.1.3","0.2.0","0.2.1","0.2.2","0.2.3","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.8.1.0","0.8.1.1","0.8.1.2","0.8.10.0","0.8.10.1","0.8.10.2","0.8.11.0","0.8.11.1","0.8.12.0","0.8.13.0","0.8.13.1","0.8.14.0","0.8.14.1","0.8.14.2","0.8.15.0","0.8.15.1","0.8.15.10","0.8.15.2","0.8.15.3","0.8.15.4","0.8.15.5","0.8.15.6","0.8.15.7","0.8.15.8","0.8.15.9","0.8.16.0","0.8.16.1","0.8.16.11","0.8.16.12","0.8.16.2","0.8.16.3","0.8.16.4","0.8.16.5","0.8.16.6","0.8.16.7","0.8.16.8","0.8.16.9","0.8.17.0","0.8.17.1","0.8.17.2","0.8.17.3","0.8.17.4","0.8.17.5","0.8.17.6","0.8.17.7","0.8.18","0.8.18.1","0.8.19.0","0.8.19.1","0.8.20.0","0.8.21.0","0.8.22.1","0.8.23.0","0.8.23.1","0.8.24.0","0.8.24.1","0.8.24.2","0.8.24.3","0.8.25","0.8.25.1","0.8.25.2","0.8.26.0","0.8.26.1","0.8.26.2","0.8.26.3","0.8.26.4","0.8.26.5","0.8.26.6","0.8.26.7","0.8.26.7rc1","0.8.26.7rc2","0.8.26.8","0.8.26.8rc1","0.8.27","0.8.27.1","0.8.27.1rc1","0.8.27.2","0.8.27.2rc1","0.8.27.2rc2","0.8.27.2rc3","0.8.28.0","0.8.28.0rc1","0.8.28.1","0.8.29","0.8.29.1","0.8.29.2","0.8.3.0","0.8.3.1","0.8.3.2","0.8.3.3","0.8.30.0","0.8.31","0.8.31.1","0.8.31.1rc1","0.8.31.2","0.8.31.3","0.8.31.3rc1","0.8.31.4","0.8.31.4rc1","0.8.31.5","0.8.31.5rc1","0.8.31.6","0.8.31.6rc1","0.8.31.6rc2","0.8.32","0.8.32.1","0.8.32.2","0.8.32.2rc1","0.8.32.3","0.8.32.3rc1","0.8.32.4","0.8.32.4rc1","0.8.32.4rc2","0.8.32.5","0.8.32.5rc1","0.8.32.6","0.8.32.6rc2","0.8.32.6rc3","0.8.32.7","0.8.32rc1","0.8.32rc2","0.8.32rc3","0.8.32rc4","0.8.33","0.8.33.1","0.8.33.2","0.8.33.2rc1","0.8.33.2rc2","0.8.33.3","0.8.33.3rc2","0.8.33.3rc3","0.8.33rc1","0.8.34","0.8.34.1","0.8.34.1rc1","0.8.34.1rc2","0.8.34.1rc3","0.8.34.2","0.8.34.2rc1","0.8.34.2rc2","0.8.34.2rc3","0.8.34.2rc4","0.8.34.3rc1","0.8.35","0.8.35.0rc2","0.8.35.1","0.8.35.1rc1","0.8.35.2","0.8.35.2rc1","0.8.35.3","0.8.35.3rc1","0.8.35.4","0.8.35.4rc1","0.8.35.5","0.8.35.5rc1","0.8.35.6","0.8.35.6rc1","0.8.35.6rc2","0.8.35.7","0.8.35.7rc1","0.8.35.8rc1","0.8.35.8rc2","0.8.35.8rc3","0.8.36","0.8.36.0rc0","0.8.36.1rc1","0.8.36.1rc10","0.8.36.1rc2","0.8.36.1rc6","0.8.36.1rc7","0.8.36.1rc8","0.8.36.1rc9","0.8.36rc1","0.8.37","0.8.37rc0","0.8.38","0.8.38.1","0.8.38.1rc0","0.8.38.1rc1","0.8.38.2","0.8.38.2rc1","0.8.38.3","0.8.38.3rc1","0.8.38.4","0.8.38.4rc0","0.8.38.4rc2","0.8.38.4rc3","0.8.38.5","0.8.38.5rc0","0.8.39","0.8.39.1rc1","0.8.39.1rc2","0.8.39.1rc3","0.8.39.1rc4","0.8.39.1rc5","0.8.39.1rc6","0.8.39.1rc7","0.8.39.1rc8","0.8.39rc0","0.8.4.0","0.8.40","0.8.40.1","0.8.40.2","0.8.40.2rc0","0.8.40.3","0.8.40.3rc0","0.8.40.3rc1","0.8.40.3rc2","0.8.40.3rc3","0.8.40.4rc1","0.8.40.4rc2","0.8.40rc1","0.8.41","0.8.41.1","0.8.41.1rc0","0.8.41.1rc1","0.8.41.1rc2","0.8.41.1rc3","0.8.41.1rc4","0.8.41.2","0.8.41.2rc0","0.8.41.2rc1","0.8.41.3rc1","0.8.41.3rc2","0.8.41.3rc3","0.8.41rc2","0.8.42","0.8.42rc1","0.8.42rc2","0.8.43","0.8.43.1","0.8.43.1rc0","0.8.43.1rc1","0.8.43.2","0.8.43.2rc0","0.8.43.2rc1","0.8.43.3","0.8.43.3rc0","0.8.43.3rc1","0.8.43.3rc2","0.8.43.3rc3","0.8.43.3rc5","0.8.43.4","0.8.43.4rc1","0.8.43.4rc2","0.8.43.5","0.8.43.5rc1","0.8.43.5rc2","0.8.43.5rc3","0.8.43.6","0.8.43.6rc0","0.8.43.6rc1","0.8.43rc2","0.8.43rc3","0.8.43rc4","0.8.44","0.8.44.1","0.8.44.1rc0","0.8.44.1rc1","0.8.44.1rc2","0.8.44.1rc3","0.8.44.1rc4","0.8.44.2","0.8.44.2rc0","0.8.44.2rc1","0.8.44.2rc2","0.8.44.3","0.8.44.3rc0","0.8.44.3rc1","0.8.44.3rc2","0.8.44.3rc3","0.8.44.3rc4","0.8.44.4","0.8.44.4rc0","0.8.44.4rc1","0.8.44.5","0.8.44.5rc0","0.8.44.5rc1","0.8.44.5rc2","0.8.44.5rc3","0.8.44.6rc0","0.8.44rc0","0.8.44rc1","0.8.44rc3","0.8.44rc4","0.8.44rc5","0.8.45rc1","0.8.5.0","0.8.5.1","0.8.5.2","0.8.6.0","0.8.6.1","0.8.6.2","0.8.6.3","0.8.6.4","0.8.6.5","0.8.7.0","0.8.8.0","0.8.8.1","0.8.8.2","0.8.8.3","0.8.8.4","0.8.9.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/acryl-datahub/PYSEC-2026-252.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L"}]}