Authentication Bypass Vulnerability Found in Auth0 Identity Platform

A critical authentication bypass vulnerability has been discovered in one of the biggest identity-as-a-service platform Auth0 that could have allowed a malicious attacker to access any portal or application, which are using Auth0 service for authentication. Auth0 offers token-based authentication...

CVE-2018-6873

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated...

CVE-2018-6873

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated...

Privilege escalation

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated...

CVE-2018-6873

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated...

CVE-2018-6873

CVE-2018-6873 affects Auth0 authentication service prior to 2017-10-15, where JWT audience validation was not performed, enabling privilege escalation. Multiple sources describe that the vulnerability allowed a remote attacker to authenticate as a higher-privilege user by forging or manipulating ...

CVE-2018-6873: Improper Authentication

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated...

PT-2018-17794

Name of the Vulnerable Software and Affected Versions Auth0 versions prior to 2017-10-15 Description The issue allows for privilege escalation due to the lack of validation of the JWT audience. Recommendations For versions prior to 2017-10-15, update to a version that includes the fix for the JWT...

Exploit for Improper Verification of Cryptographic Signature in Cisco Node-Jose

POC-CVE-2018-0114 This repository contains the POC of an explo...

Timing Attack

authentikat-jwt is vulnerable to timing attacks. The vulnerability exists as the insecure function, contentEquals, used to compare between two given signatures in verify, was not constant, and results in the leaking of sensitive information from the signature...

Input validation

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt aka com.jason-goodwin/authentikat-jwt version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature b...

CVE-2017-18239

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt aka com.jason-goodwin/authentikat-jwt version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature b...

CVE-2017-18239

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt aka com.jason-goodwin/authentikat-jwt version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature b...

CVE-2017-18239

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt aka com.jason-goodwin/authentikat-jwt version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature b...

CVE-2017-18239

The CVE-2017-18239 entry concerns the authentikat-jwt library (Scala) in main/scala/authentikat/jwt/JsonWebToken.scala. A time-sensitive equality check in JsonWebToken.validate for the JWT signature (versions 0.4.5 and earlier) can allow an attacker to recover the signature bit-by-bit by issuing ...

CVE-2017-18239: Undefined Security Weakness

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt aka com.jason-goodwin/authentikat-jwt version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature b...

PT-2018-6764

Name of the Vulnerable Software and Affected Versions: authentikat-jwt versions 0.4.5 and earlier Description: A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method allows the supplier of a JWT token to guess bit after bit of the signature by repeating validatio...

Unspecified Vulnerability in inversoft prime-jwt

inversoft prime-jwt is an open source Java 8-based JWT library . A security vulnerability exists in JWTDecoder.decode in versions prior to inversoft prime-jwt 1.3.0 and commit 0d94dcef0133d699f21d217e922564adbb83a227. No details of the vulnerability are provided at this time...

Improper Validation Of JWT Token

prime-jwt is vulnerable to unauthorized access through Improper Validation of JWT Token. The vulnerability exists as the decode method in JWTDecoder successfully validates a JWT token, with a valid header and body, but without a valid signature...

Input validation

inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack...