# CVE-2021-27884: YMFE YApi weak JWT secret generation in yapi-vendor

Source: https://junglewise.ai/threats/cve-2021-27884-ymfe-yapi-weak-jwt-secret-generation-in-yapi-vendor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-03-26. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2021-27884 · Severity: low · CVSS 3.1 · Published 2021-03-26

YMFE YApi is an API management platform. A vulnerability in how it generates security tokens allows an attacker to potentially predict and recreate login tokens for other users. This could lead to unauthorized access to the platform and sensitive API documentation.

Technologies: [yapi-vendor (npm)](https://junglewise.ai/threats/technologies/yapi-vendor), [Ymfe Yapi](https://junglewise.ai/threats/technologies/yapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Ymfe](https://junglewise.ai/threats/vendors/ymfe).

## Quick answers

**Is CVE-2021-27884 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-27884 being exploited in the wild.

**How severe is CVE-2021-27884?** Low severity, with a CVSS score of 3.1, published 26 March 2021.

**Which products and versions are affected?** yapi-vendor (npm) SEMVER:introduced=0,fixed=1.9.3; Ymfe Yapi <= 1.9.2.

**Is there a fix for CVE-2021-27884?** Yes. yapi-vendor (npm): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-27884 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2021-27884?** Check whether you run yapi-vendor (npm) or Ymfe Yapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- yapi-vendor (npm): upgrade to 1.9.3 or later

  ```sh
  npm install yapi-vendor@1.9.3
  ```


## Technical details

The yapi-vendor package (used by YApi) utilizes Node.js's Math.random() to generate the 'passsalt' string, which serves as the secret for signing JSON Web Tokens (JWT). Because Math.random() is a cryptographically insecure pseudo-random number generator (PRNG) based on the XorShift128+ algorithm, its internal state can be recovered by observing a sequence of outputs. An attacker can register multiple accounts to observe consecutive tokens, recover the PRNG state, and then brute-force or predict the signing secrets for other users' tokens. This vulnerability is fixed in version 1.9.3 by using a cryptographically secure random source.

## Affected products

- YMFE yapi-vendor <= 1.9.2

## Identifiers

- CVE-2021-27884
- GHSA-2h3h-vw8r-82rp

## Timeline

- 2020-11-18: disclosed: Report sent to maintainer
- 2021-03-01: advisory: NVD published date
- 2021-03-26: patched: GHSA published and fix confirmed in 1.9.3

## References

- [https://github.com/YMFE/yapi/issues/2117](https://github.com/YMFE/yapi/issues/2117)
- [https://github.com/YMFE/yapi/issues/2263](https://github.com/YMFE/yapi/issues/2263)

## Related threats

- [An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.](https://junglewise.ai/threats/cve-2025-70060-an-issue-pertaining-to-cwe-79-improper-neutralization-of-input)
- [YMFE yapi TLS/SSL certificate validation bypass](https://junglewise.ai/threats/cve-2025-70058-ymfe-yapi-tls-ssl-certificate-validation-bypass)
- [YApi stored cross-site scripting in interface remarks](https://junglewise.ai/threats/cve-2021-36686-yapi-stored-cross-site-scripting-in-interface-remarks)
- [YMFE YApi stored cross-site scripting in project name](https://junglewise.ai/threats/cve-2018-17574-ymfe-yapi-stored-cross-site-scripting-in-project-name)