Authentication flaw

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allowmissing requirement under...

PT-2021-14460 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy version 1.17.0 Description: The issue allows an attacker to bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allow missing...