CVE-2024-25190

2024-02-0817:15:11

Google

osv.dev

cve-2024-25190

software

authentication

vulnerability

timing side channel

memcmp

constant time

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

43.1%

JSON

l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

CPENameOperatorVersion
l8w8jwteq2.1.3
l8w8jwteq2.1.8
l8w8jwteq2.1.6
l8w8jwteq2.2.0
l8w8jwteq2.1.2
l8w8jwteq2.1.4
l8w8jwteq2.1.7
l8w8jwteq2.1.5
l8w8jwteq2.1.1
l8w8jwteq2.1.0