Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
308 results · page 6 of 7
May 24, 2022PyJWT is a Python implementation of RFC 7519.CVE-2022-29217 · Other software · jpadilla · reported by GitHubHigh 7.4
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify `jwt.algorithms.get_default_algorithms()` to get support for all algorithms, or specify a single algorithm. The issue is not that big as `algorithms=jwt.algorithms.get_default_algorithms()` has to be used. Users should upgrade to v2.4.0 to receive a patch for this issue. As a workaround, always be explicit with the algorithms that are accepted and expected when decoding.
- Product
- pyjwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependencyCVE-2022-29266 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.
- Product
- Apache APISIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Apr 1, 2022IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token.CVE-2022-22332 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131.
- Product
- Sterling Partner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 29, 2022In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaCVE-2021-46743 · Computers, phones & browsers · Google · reported by MITRECritical 9.1
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.
- Product
- Firebase Php-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed verCVE-2021-23207 · Other software · Fresenius Kabi · reported by ics-cert@hq.dhs.govMedium 6.5
An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ queues and messages by impersonating users.
- Product
- Vigilant Software Suite (Mastermed Dashboard)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installationsCVE-2022-22845 · Other software · Qxip · reported by MITRECritical 9.8
QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations.
- Product
- Homer Webapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsipcapture.orggithub.com
Jan 4, 2022A flaw was found with the JWT token.CVE-2021-45389 · Other software · Starwind · reported by MITRECritical 9.8
A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864.
- Product
- Command Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarwindsoftware.comstarwindsoftware.com
Dec 27, 2021Simple JWT Login: Can be used to create new WordPress user accounts with a randomly generated passwordCVE-2021-24998 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.
- Product
- Simple JWT Login
- Fixed in
- 3.3.0
- What to do
- Update Simple JWT Login to 3.3.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 17, 2021Simple JWT Login: Does not have nonce checksCVE-2021-24804 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.
- Product
- Simple JWT Login
- Fixed in
- 3.2.1
- What to do
- Update Simple JWT Login to 3.2.1 or newer.
Sep 28, 2021JWT is a library to work with JSON Web Token and JSON Web Signature.CVE-2021-41106 · Other software · lcobucci · reported by GitHubMedium 4.4
JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens issued/validated using the file path as hashing key - instead of the contents. The HMAC hashing functions take any string as input and, since users can issue and validate tokens, users are lead to believe that everything works properly. Versions 3.4.6, 4.0.4, and 4.1.5 have been patched to always load the file contents, deprecated the `Lcobucci\JWT\Signer\Key\LocalFileReference`, and suggest `Lcobucci\JWT\Signer\Key\InMemory` as the alternative. As a workaround, use `Lcobucci\JWT\Signer\Key\InMemory` instead of `Lcobucci\JWT\Signer\Key\LocalFileReference` to create the instances of one's keys.
- Product
- jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2021A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.CVE-2021-40494 · Other software · Adaptivescale · reported by MITRECritical 9.8
A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.
- Product
- Lxdui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2021If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithmCVE-2021-22160 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
- Product
- Apache Pulsar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Apr 12, 2021A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT tokenCVE-2021-22190 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.5
A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JCVE-2021-22696 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.
- Product
- Apache CXF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcxf.apache.org
Mar 18, 2021An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without CVE-2021-27306 · Other software · Konghq · reported by MITREHigh 7.5
An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT.
- Product
- Kong Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.konghq.commedium.com
Mar 16, 2021NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.CVE-2021-3127 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
- Product
- Nats-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.nats.ioadvisories.nats.io
Mar 15, 2021In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.CVE-2021-3167 · Other software · Cloudera · reported by MITREMedium 6.5
In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.
- Product
- Data Engineering
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloudera.comdocs.cloudera.com
Mar 1, 2021Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens.CVE-2021-27884 · Other software · Ymfe · reported by MITREMedium 5.1
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
- Product
- Yapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Dec 18, 2020Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active.CVE-2020-26172 · Other software · Tangro · reported by MITREMedium 4.2
Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.
- Product
- Business Workflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2020InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an emptyCVE-2019-20933 · Other software · Influxdata · reported by MITRECritical 9.8
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
- Product
- Influxdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2020The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.CVE-2020-26892 · Computers, phones & browsers · Linuxfoundation · reported by MITRECritical 9.8
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
- Product
- Nats-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Nov 6, 2020The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).CVE-2020-26521 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
- Product
- Nats-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Nov 2, 2020ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum lengtCVE-2020-28042 · Other software · Servicestack · reported by MITREMedium 5.3
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
- Product
- Servicestack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.servicestack.netgithub.com
Oct 21, 2020omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method.CVE-2020-15240 · Other software · auth0 · reported by GitHubHigh 7.4
omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all of the following conditions apply: 1. You are using `omniauth-auth0`. 2. You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDK’s default Authorization Code Flow. The issue is patched in version 2.4.1.
- Product
- omniauth-auth0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token.CVE-2020-26511 · WordPress plugins & themes · reported by MITREHigh 7.5
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.
- Product
- wpo365-login
- Fixed in
- 11.7
- What to do
- Update wpo365-login to 11.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 30, 2020jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specifiCVE-2020-26160 · Other software · Jwt-go Project · reported by MITREHigh 7.5
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
- Product
- Jwt-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2020In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness ofCVE-2020-15222 · Other software · ory · reported by GitHubHigh 8.1
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not seem to check the uniqueness of this `jti` value. This problem is fixed in version 0.31.0.
- Product
- fosite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2020In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced.CVE-2020-15084 · Other software · auth0 · reported by GitHubHigh 7.7
In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.
- Product
- express-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2020An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could CVE-2020-1762 · Other software · [Kiali] · reported by Red HatHigh 7
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
- Product
- kiali
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comkiali.io
Mar 20, 2020Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance.CVE-2019-19324 · Other software · Xmidt · reported by MITREHigh 7.5
Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance.
- Product
- Cjwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2020An issue was discovered in drf-jwt 1.15.x before 1.15.1.CVE-2020-10594 · Other software · Styria · reported by MITRECritical 9.1
An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
- Product
- Django-rest-framework-json Web Tokens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2019The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.CVE-2019-18848 · Other software · Json-jwt Project · reported by MITREHigh 7.5
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
- Product
- Json-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2019Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential informatCVE-2019-17195 · Other software · Connect2id · reported by MITRECritical 9.8
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
- Product
- Nimbus Jose+jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgconnect2id.com
Aug 13, 2019Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HCVE-2019-14993 · Other software · Istio · reported by MITREHigh 7.5
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.
- Product
- Istio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.istio.iogcc.gnu.org
Jul 29, 2019graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.CVE-2019-1020015 · Other software · graphql-engine · reported by josh@bress.netHigh 7.5
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
- Product
- graphql-engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2019Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing.CVE-2019-13483 · Email & office · Auth0 · reported by MITREHigh 7.3
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
- Product
- Passport-sharepoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2019perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control.CVE-2019-1010161 · Other software · perl-CRYPT-JWT · reported by josh@bress.netCritical 9.8
perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in _decode_jws(). The attack vector is: network connectivity(crafting user-controlled input to bypass authentication). The fixed version is: 0.023.
- Product
- perl-CRYPT-JWT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2019Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control.CVE-2019-1010263 · Other software · Perl Crypt::JWT · reported by josh@bress.netCritical 9.8
Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b2560410106207c2152d6c.
- Product
- Perl Crypt::JWT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Apr 24, 2019Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC.CVE-2019-3868 · Other software · Red Hat · reported by Red HatLow 3.8
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
- Product
- keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Apr 11, 2019Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature.CVE-2019-7644 · Other software · Auth0 · reported by MITRECritical 9.8
Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application.
- Product
- Auth0-wcf-service-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2018Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation.CVE-2018-15801 · Other software · Spring by Pivotal · reported by security_alert@emc.comHigh 7.4
Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.
- Product
- Spring Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2018Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT).CVE-2018-8023 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
- Product
- Apache Mesos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jun 26, 2018Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JCVE-2018-1000539 · Other software · Json-jwt Project · reported by MITREMedium 5.3
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.
- Product
- Json-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an CVE-2018-1000531 · Other software · Inversoft · reported by MITREHigh 7.5
inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header using 'none' as algorithm and a body to requests it be validated. This vulnerability was fixed after commit abb0d479389a2509f939452a6767dc424bb5e6ba.
- Product
- Prime-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2018Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvCVE-2018-11537 · Other software · Auth0 · reported by MITREMedium 6.5
Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.
- Product
- Angular-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2018Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server.CVE-2016-10555 · Other software · HackerOne · reported by support@hackerone.comMedium 6.5
Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.
- Product
- jwt-simple node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2018When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.CVE-2016-10525 · Other software · HackerOne · reported by support@hackerone.comCritical 9.8
When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.
- Product
- hapi-auth-jwt2 node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2018The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.CVE-2018-6873 · Other software · Auth0 · reported by MITRECritical 9.8
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.
- Product
- Auth0.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comauth0.com
Mar 17, 2018A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (akCVE-2017-18239 · Other software · Authentikat-jwt Project · reported by MITRECritical 9.8
A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
- Product
- Authentikat-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2018inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTCVE-2018-1000125 · Other software · Inversoft · reported by MITRECritical 9.8
inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack appear to be exploitable via an attacker crafting a token with a valid header and body and then requests it to be validated. This vulnerability appears to have been fixed in 1.3.0 and later or after commit 0d94dcef0133d699f21d217e922564adbb83a227.
- Product
- Prime-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.