Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: auth0 Component: Jsonwebtoken Clear all filters
TI-2022-07594 CVE-2022-23539 · GHSA-8cf7-32gw-wr33

jsonwebtoken unrestricted key type could lead to legacy keys usage

Priority LOW 36

Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00524 Published 2022-12-22 Partial fix · 9.0.0 CWE-327
TI-2022-07595 CVE-2022-23540 · GHSA-qwph-4952-7xr6

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Priority LOW 34

In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00572 Published 2022-12-22 Partial fix · 9.0.0 CWE-287
TI-2015-07615 CVE-2015-9235 · GHSA-c7hr-j4mj-j2w6

Improper input validation in HackerOne jsonwebtoken node module

Priority MEDIUM 53

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digit…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08367 Published 2018-05-29 Fixed in 4.2.2 CWE-20