GHSA-QWPH-4952-7XR6 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Overview In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Am I affected? You will be affected if all the followi...

jsonwebtoken unrestricted key type could lead to legacy keys usage

Overview Versions =8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. Am I affected? You are affected if you are using an algorithm and a key type other than the...

GHSA-27H2-HVPR-P74Q jsonwebtoken has insecure input validation in jwt.verify function

Overview For versions =8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter referring to the secretOrPublicKey argument from the readme link of the jwt.verify function, they can gain remote code execution RCE. Am I affected? This security issue...

jsonwebtoken has insecure input validation in jwt.verify function

Overview For versions =8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter referring to the secretOrPublicKey argument from the readme link of the jwt.verify function, they can gain remote code execution RCE. Am I affected? This security issue...

jsonwebtoken 数据伪造问题漏洞

jsonwebtoken is Auth0 open source implementation of a JSON Web token . jsonwebtoken version 8.5.1 and earlier versions of data forgery vulnerability , the vulnerability stems from the default use of the "none" algorithm for signature verification , jwt.verify function in the lack of algorithm...

PT-2022-16059

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions =8.5.1 Description The jsonwebtoken library could be misconfigured to use legacy, insecure key types for signature verification. For example, DSA keys could be used with the RS256 algorithm. Users are affected if they use...

PT-2022-16062

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions = 8.5.1 Description The jsonwebtoken library can be misconfigured, leading to incorrect verification of tokens. This occurs when a poorly implemented key retrieval function is used, referring to the secretOrPublicKey...

PT-2022-16061

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions =8.5.1 Description The issue arises from the lack of algorithm definition in the jwt.verify function, leading to a signature validation bypass due to defaulting to the none algorithm for signature verification. This occur...

jsonwebtoken 安全漏洞

jsonwebtoken is a JSON Web token implementation of Auth0 open source. A security vulnerability exists in jsonwebtoken version 8.5.1 and earlier versions, which stems from a key retrieval function that will result in a token validation error...

Exposure of Sensitive information in authentikat-jwt

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt aka com.jason-goodwin/authentikat-jwt version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature b...

@irjudson/nitrogen-mongodb-providers (=0.3.7), ah-auth-plugin (=0.0.1) +101 more potentially affected by CVE-2015-9235 via jsonwebtoken (>=0.1.0 <=4.0.0)

jsonwebtoken NPM version =0.1.0, =0.0.2, =0.1.0, =0.0.7, =0.0.4, =1.0.0, =0.1.0, =0.0.1, =0.0.0, =0.0.2 and more Source cves: CVE-2015-9235 Source advisory: OSV:GHSA-C7HR-J4MJ-J2W6...

GHSA-C7HR-J4MJ-J2W6 Verification Bypass in jsonwebtoken

Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. Recommendation Update to version 4.2.2 or later...

jsonwebtoken node module bypass authentication vulnerability

The jsonwebtoken node module is a JSON Web Taken JWT implementation for node.js. A security vulnerability exists in the jsonwebtoken node module prior to version 4.2.2, which stems from the program using the same signature to validate two types of tokens. An attacker could use this vulnerability ...

CVE-2015-9235

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key RS/ES family of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm HS family...

CVE-2015-9235

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key RS/ES family of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm HS family...

Design/Logic Flaw

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key RS/ES family of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm HS family...

CVE-2015-9235

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key RS/ES family of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm HS family...

CVE-2015-9235

CVE-2015-9235 affects the jsonwebtoken Node.js module (pre-4.2.2). The vulnerability allows bypass of token verification when a token signed with RS/ES (asymmetric) is presented but validated with a symmetric HS* algorithm due to weak validation of the JWT algorithm type. This leads to potential ...

PT-2018-4549

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions 4.2.1 and earlier Description The issue allows an attacker to bypass verification when a token digitally signed with an asymmetric key is sent, but the attacker instead sends a token digitally signed with a symmetric...

CVE-2017-18239

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt aka com.jason-goodwin/authentikat-jwt version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature b...