Forgeable Public/Private Tokens in jwt-simple

🗓️ 06 Nov 2018 23:12:07Reported by GitHub Advisory DatabaseType

Forgeable Public/Private Tokens in jwt-simple. Affected package allows user to select verification algorithm, leading to content modification and authentication bypass. Update to v0.3.1+ and specify algorithm in calls to .decode().

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2016-10555	2 Aug 202310:00	–	circl
CVE	CVE-2016-10555	31 May 201820:00	–	cve
Cvelist	CVE-2016-10555	31 May 201820:00	–	cvelist
GithubExploit	jwt-attack-suite	14 Apr 202606:44	–	githubexploit
GithubExploit	Exploit for CVE-2016-10555	4 Mar 202613:34	–	githubexploit
Node.js	Forgeable Public/Private Tokens	21 Mar 201617:05	–	nodejs
NVD	CVE-2016-10555	31 May 201820:29	–	nvd
OSV	GHSA-VGRX-W6RG-8FQF Forgeable Public/Private Tokens in jwt-simple	6 Nov 201823:12	–	osv
Prion	Code injection	31 May 201820:29	–	prion
vulnersOsv	@sysdoc/sysdoc-web-stack (=1.0.0), ac-koa-hipchat (>=0.1.0 <=0.2.20) +182 more potentially affected by CVE-2016-10555 via jwt-simple (>=0.1.0 <=0.3.0)	6 Nov 201823:12	–	vulnersosv

Vulners

Node

jwt-simple_project jwt-simpleRange<0.3.1npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2016-10555
github	www.github.com/hokaccha/node-jwt-simple/pull/16
github	www.github.com/hokaccha/node-jwt-simple/commit/957957cfa44474049b4603b293569588ee9ffd97
npmjs	www.npmjs.com/advisories/87
github	www.github.com/hokaccha/node-jwt-simple/pull/14
auth0	www.auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
github	www.github.com/advisories/GHSA-vgrx-w6rg-8fqf

09 Jan 2023 05:03Current

3.6Low risk

Vulners AI Score3.6

CVSS 24

CVSS 36.5

EPSS0.81652

CWE-20