132 matches found
CVE-2022-23529-Exploration
CVE-2022-23529 JSON Web Token JWT ライブラリのバージョン 3.4.6 未満、4.0.4 未満、および 4.1.5 未満には、リモートコード実行 RCE の脆弱性があります。 HMAC ハッシュ関数は任意の文字列を入力として受け取るため、RCE が発生します。 前提条件により、この脆弱性は悪用される可能性が低いです。 この脆弱性を悪用するには、攻撃者は以下のいずれかの条件を満たす必要があります： サーバーが秘密鍵を安全に保管していない。 攻撃者が秘密鍵にアクセスし、制御する必要がある。 npm install [email protected]...
ROOT-APP-NPM-CVE-2015-9235 CVE-2015-9235 in jsonwebtoken - Patched by Root
Root has patched CVE-2015-9235 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-23539 CVE-2022-23539 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23539 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-NSWG-ECO-17 NSWG-ECO-17 in jsonwebtoken - Patched by Root
Root has patched NSWG-ECO-17 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-23529 CVE-2022-23529 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23529 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
CVE-2026-82454
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CVE-2026-82454
CVE-2026-82454 is a CRITICAL authentication bypass in the Omnivore API (packages/api), affecting versions before android-0.227.0 . The decodeAppleToken function extracted the alg field from an attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Because jsonwe...
CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
EUVD-2026-68109
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
PT-2026-83433
Name of the Vulnerable Software and Affected Versions Omnivore API packages/api versions prior to commit abf53d6 Description An authentication bypass exists in the Apple sign-in token verification process. The decodeAppleToken function extracts the alg field from the JWT header provided by the us...
CVE-2026-82454: Improper Verification of Cryptographic Signature
The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...
CLSA-2026-1787322010 TuxCare security update for jsonwebtoken (3 CVEs)
TuxCare rebuilt jsonwebtoken to address 3 CVEs. Fixed in 0.3.0-tuxcare.3...
CLSA-2026-1787321999 TuxCare security update for jsonwebtoken (2 CVEs)
TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.7...
ROOT-APP-NPM-CVE-2022-23541 CVE-2022-23541 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23541 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-23540 CVE-2022-23540 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23540 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
CLSA-2026-1786361774 TuxCare security update for jsonwebtoken (2 CVEs)
TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 5.4.0-tuxcare.1...