Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the parse method of DefaultJwtParser, whose verification block is entered only when base64UrlEncodedDigest != null, so a token with a trailing dot and no third segment skips it...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the parse method of DefaultJwtParser, whose verification block is entered only when base64UrlEncodedDigest != null, so a token with a trailing dot and no third segment skips it...

Withdrawn: JJWT improperly generates signing keys

Withdrawn Advisory This advisory has been withdrawn because it has been found to be disputed. Please see the issue here for more information. Original Description JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The...

CVE-2024-31033

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

CVE-2024-31033: Undefined Security Weakness

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

CVE-2024-31033

The JJWT (Java JWT) library through version 0.12.5 contains a vulnerability where it ignores certain characters, potentially leading users to believe they possess a stronger key than they actually do. This issue affects the setSigningKey() method in the DefaultJwtParser class and the signWith() m...