Jwt-simple Project

Records1All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Jwt-simple Project records in CISA KEV

No Jwt-simple Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Jwt-simple 1 record LOW

Records

1 record in Jwt-simple · all components

TI-2016-08596 CVE-2016-10555 · GHSA-vgrx-w6rg-8fqf

Improper input validation in HackerOne jwt-simple node module

LOW 37

Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04823 Published 2018-05-31 Fixed in 0.3.1 CWE-20

Open these records in search →

Critical	0
High	0
Medium	1
Low	0
No CVSS	0