132 matches found
CVE-2022-23529-Exploration
CVE-2022-23529 3.4.6、4.0.4 和 4.1.5 之前的 JSON Web Token JWT 库版本存在 RCE 漏洞。 HMAC 哈希函数接受任意字符串作为输入，从而导致 RCE。 由于前提条件，该漏洞不太可能被利用。 要利用此漏洞，攻击者需要满足以下条件之一： 服务器未安全存储密钥。 攻击者需要能够访问并控制密钥。 npm install [email protected] var jwt = require'jsonwebtoken'; 使用服务器密钥创建令牌 var token = jwt.sign"x":"y", 'serverssecret';...
ROOT-APP-NPM-CVE-2015-9235 CVE-2015-9235 in jsonwebtoken - Patched by Root
Root has patched CVE-2015-9235 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-NSWG-ECO-17 NSWG-ECO-17 in jsonwebtoken - Patched by Root
Root has patched NSWG-ECO-17 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-23529 CVE-2022-23529 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23529 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-23539 CVE-2022-23539 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23539 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
CVE-2026-82454
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CVE-2026-82454
CVE-2026-82454 is a CRITICAL authentication bypass in the Omnivore API (packages/api), affecting versions before android-0.227.0 . The decodeAppleToken function extracted the alg field from an attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Because jsonwe...
CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
EUVD-2026-68109
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CVE-2026-82454: Improper Verification of Cryptographic Signature
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
PT-2026-83433
Name of the Vulnerable Software and Affected Versions Omnivore API packages/api versions prior to commit abf53d6 Description An authentication bypass exists in the Apple sign-in token verification process. The decodeAppleToken function extracts the alg field from the JWT header provided by the us...
CLSA-2026-1787322010 TuxCare security update for jsonwebtoken (3 CVEs)
TuxCare rebuilt jsonwebtoken to address 3 CVEs. Fixed in 0.3.0-tuxcare.3...
CLSA-2026-1787321999 TuxCare security update for jsonwebtoken (2 CVEs)
TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.7...
ROOT-APP-NPM-CVE-2022-23541 CVE-2022-23541 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23541 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-23540 CVE-2022-23540 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23540 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
CLSA-2026-1786361774 TuxCare security update for jsonwebtoken (2 CVEs)
TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 5.4.0-tuxcare.1...