Signature replacement attack in the jsjws package allows attackers to bypass the verification step if a server is expecting a token signed with RSA, but actually receives a token signed with HMAC...
9.3CVSS5.8AI score
SaveExploits0References1
Mend•added 2026/05/14 12:35 a.m.•0 views
WS-2015-0048
jsjws 2.0.2 and before validation accepts any supported algorithm as valid including none...
