Missing validation of JWT signature
Priority LOW 34CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs.
Why it matters now
EPSS 0.00595 48th percentileScored 2026-11-07
Fix Fixed bubble-fireworks (fxbin): 2021.BUILD-SNAPSHOT
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fxbin | bubble-fireworks | before 2021.BUILD-SNAPSHOT | 2021.BUILD-SNAPSHOT | Patch available | CNA |
- bubble-fireworks Vendorfxbin Affected before 2021.BUILD-SNAPSHOT Fixed in 2021.BUILD-SNAPSHOT Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bubble_fireworks_project:bubble_fireworks:*:*:*:*:*:*:*:* | before 2021.build-snapshot | Vulnerable | Bubble Fireworks Project |
- cpe:2.3:a:bubble_fireworks_project:bubble_fireworks:*:*:*:*:*:*:*:* Versions before 2021.build-snapshot Vulnerable ·Bubble Fireworks Project
Remediation
- Fix · CNA bubble-fireworks (fxbin) Fixed in 2021.BUILD-SNAPSHOT
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29500
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences