WS-2021-0046

A verification flaw in the implementation of the identity token verifier library https://github.com/solid/identity-token-verifier allows DPoP proofs to be spoofed. DPoP proofs are used to bind access tokens to a private key meant to be in sole possession of a specific user. Instead of verifying...

Verification flaw in Solid identity-token-verifier

Impact Severity Any Pod on a Solid server using a vulnerable version of the identity-token-verifier library is at risk of a spoofed Demonstration of Proof-of-Possession DPoP token binding. This vulnerability could give total and complete access to a targeted Pod. Summary A verification flaw in th...

@solid/community-server (0.4.1) potentially affected by unknown CVE via @solid/identity-token-verifier (0.4.3)

@solid/identity-token-verifier NPM version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on @solid/identity-token-verifier and may be impacted: - @solid/community-server 0.4.1 Source cves: unknown CVE Source advisory: OSV:GHSA-XMH9-RG6F-J3MR...

PT-2021-24475

Name of the Vulnerable Software and Affected Versions: identity-token-verifier versions prior to 0.5.2 Description: A verification flaw in the identity token verifier library allows Demonstration of Proof-of-Possession DPoP proofs to be spoofed, potentially giving an attacker total access to a...