Forgeable Public/Private Tokens in jwt-simple

🗓️ 06 Nov 2018 23:12:07Reported by GitHub Advisory DatabaseType

Forgeable Public/Private Tokens in jwt-simple. Affected package allows user to select verification algorithm, leading to content modification and authentication bypass. Update to v0.3.1+ and specify algorithm in calls to .decode().

Reporter	Title	Published	Views	Family All 17
Circl	CVE-2016-10555	2 Aug 202310:00	–	circl
CVE	CVE-2016-10555	31 May 201820:00	–	cve
Cvelist	CVE-2016-10555	31 May 201820:00	–	cvelist
GithubExploit	jwt-attack-suite	14 Apr 202606:44	–	githubexploit
GithubExploit	Exploit for CVE-2016-10555	4 Mar 202613:34	–	githubexploit
Kitploit	jwt_tool	6 Oct 202619:11	–	kitploit
Kitploit	poc-cve-2016-10555	5 Oct 202620:41	–	kitploit
Kitploit	PoC-CVE-2016-10555	3 Oct 202613:05	–	kitploit
Kitploit	jwt_tool	6 Oct 202619:11	–	kitploit
Mend	CVE-2016-10555	31 May 201820:00	–	mend

Vulners

Node

jwt-simple_project jwt-simpleRange<0.3.1npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2016-10555
github	www.github.com/hokaccha/node-jwt-simple/pull/16
github	www.github.com/hokaccha/node-jwt-simple/commit/957957cfa44474049b4603b293569588ee9ffd97
npmjs	www.npmjs.com/advisories/87
github	www.github.com/hokaccha/node-jwt-simple/pull/14
auth0	www.auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
github	www.github.com/advisories/GHSA-vgrx-w6rg-8fqf

09 Jan 2023 05:03Current

6.9Medium risk

Vulners AI Score6.9

CVSS 24

CVSS 36.5

EPSS0.04858

CWE-20