Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
309 results · page 5 of 7
Nov 4, 2024golang-jwt is a Go implementation of JSON Web Tokens.CVE-2024-51744 · Other software · golang-jwt · reported by GitHubLow 3.1
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for
- Product
- jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSONCVE-2024-7783 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.5
mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it and retrieve the password. The issue is fixed in version 1.0.3.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicioCVE-2023-32188 · Other software · SUSE · reported by meissner@suse.deCritical 9.4
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
- Product
- neuvector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Sep 24, 2024IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.CVE-2024-46612 · Other software · icecms_project · reported by MITRECritical 9.8
IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.
- Product
- icecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method.CVE-2024-5798 · Other software · HashiCorp · reported by security@hashicorp.comLow 2.6
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Jun 11, 2024Hard-coded JWT secret allows authentication bypass in Veeam Recovery OrchestratorCVE-2024-29855 · Other software · Veeam · reported by support@hackerone.comCritical 9
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
- Product
- Recovery Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT.CVE-2024-32988 · Other software · i-plug inc. · reported by vultures@jpcert.or.jpHigh 7.5
'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT may be retrieved if the application binary is reverse-engineered.
- Product
- 'OfferBox' App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2024njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.CVE-2024-34273 · Other software · jwtk · reported by MITREMedium 5.9
njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.
- Product
- njwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2024CyberPower PowerPanel business application code contains a hard-coded JWT signing key.CVE-2024-33625 · Other software · CyberPower · reported by ics-cert@hq.dhs.govCritical 9.8
CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens to bypass authentication.
- Product
- PowerPanel business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govcyberpower.com
Apr 24, 2024cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM.CVE-2024-33531 · Other software · cdbattags · reported by MITREHigh 8.1
cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM.
- Product
- lua_resty_jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout.CVE-2024-2260 · Other software · zenml-io · reported by security@huntr.devMedium 4.2
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request.CVE-2024-1233 · Other software · Red Hat · reported by Red HatHigh 7.3
A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.
- Product
- Red Hat JBoss Enterprise Application Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 31, 2024JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key.CVE-2024-31033 · Other software · jwtk · reported by MITREMedium 6.8
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
- Product
- jjwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2024djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure.CVE-2024-22513 · Other software · reported by MITREMedium 5.5
djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWCVE-2024-28176 · Other software · panva · reported by GitHubMedium 4.9
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
- Product
- jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024 JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies.CVE-2024-28122 · Other software · lestrrat-go · reported by GitHubMedium 6.8
JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.
- Product
- jwx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack.CVE-2023-51774 · Other software · json-jwt_project · reported by MITREHigh 8.4
The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode.
- Product
- json-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2024In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration coCVE-2023-52428 · Other software · Connect2id · reported by MITREHigh 7.5
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
- Product
- Nimbus Jose+jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbitbucket.org
Feb 8, 2024An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resultingCVE-2023-27001 · Other software · Egerie · reported by MITREHigh 8.8
An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resulting in privilege escalation.
- Product
- Egerie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.CVE-2024-25191 · Other software · Zihanggao · reported by MITRECritical 9.8
php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
- Product
- Php-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.CVE-2024-25190 · Other software · glitchedpolygons · reported by MITRECritical 9.8
l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
- Product
- l8w8jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.CVE-2024-25189 · Other software · bencollins · reported by MITRECritical 9.8
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
- Product
- jwt_c_library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 6, 2024Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.CVE-2023-40545 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 8.8
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
- Product
- PingFederate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.comsupport.pingidentity.com
Jan 9, 2024jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies.CVE-2024-21664 · Other software · lestrrat-go · reported by GitHubMedium 4.3
jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.
- Product
- jwx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2023Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens.CVE-2023-27172 · Other software · Xpand-it · reported by MITRECritical 9.1
Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via a bruteforce attack.
- Product
- Write-back Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbalwurk.github.ioghostline.neocities.org
Dec 11, 2023A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary uCVE-2023-36647 · Other software · Prolion · reported by MITREHigh 7.5
A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.
- Product
- Cryptospike
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvcn.gov.itcvcn.gov.it
Dec 4, 2023lestrrat-go/jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies.CVE-2023-49290 · Other software · lestrrat-go · reported by GitHubMedium 5.3
lestrrat-go/jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. A p2c parameter set too high in JWE's algorithm PBES2-* could lead to a denial of service. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource- intensive. Therefore, if an attacker sets the p2c parameter in JWE to a very large number, it can cause a lot of computational consumption, resulting in a denial of service. This vulnerability has been addressed in commit `64f2a229b` which has been included in release version 1.2.27 and 2.0.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- jwx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2023Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret.CVE-2023-47315 · Other software · H-mdm · reported by MITREHigh 8.8
Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens.
- Product
- Headwind MDM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordboltonshield.comboltonshield.com
Nov 20, 2023An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).CVE-2023-48176 · Other software · Mizhexiaoxiao · reported by MITRECritical 9.8
An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).
- Product
- Websiteguide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprairie-steed-4d7.notion.siteprairie-steed-4d7.notion.site
Nov 20, 2023fast-jwt provides fast JSON Web Token (JWT) implementation.CVE-2023-48223 · Other software · nearform · reported by GitHubMedium 5.9
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work if the victim application utilizes a public key containing the `BEGIN RSA PUBLIC KEY` header. Applications using the RS256 algorithm, a public key with a `BEGIN RSA PUBLIC KEY` header, and calling the verify function without explicitly providing an algorithm, are vulnerable to this algorithm confusion attack which allows attackers to sign arbitrary payloads which will be accepted by the verifier. Version 3.3.2 contains a patch for this issue. As a workaround, change line 29 of `blob/master/src/crypto.js` to include a regular expression.
- Product
- fast-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to beCVE-2023-48238 · Other software · joaquimserafim · reported by GitHubHigh 7.5
joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to be transferred between two parties. Versions prior to 4.0.0 are vulnerable to a JWT algorithm confusion attack. On line 86 of the 'index.js' file, the algorithm to use for verifying the signature of the JWT token is taken from the JWT token, which at that point is still unverified and thus shouldn't be trusted. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work against this library is the RS256 algorithm is in use, however it is a best practice to use that algorithm. Version 4.0.0 fixes the issue.
- Product
- json-web-token
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28CVE-2023-5074 · Network & remote access · D-Link · reported by vulnreport@tenable.comCritical 9.8
Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28
- Product
- D-View 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Sep 20, 2023A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicioCVE-2023-22644 · Other software · SUSE · reported by meissner@suse.deCritical 9.4
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
- Product
- neuvector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Aug 16, 2023An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.CVE-2023-39846 · Other software · Pantsel · reported by MITRECritical 9.8
An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.
- Product
- Konga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabyssaler.github.ioabyssaler.github.io
Aug 9, 2023HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities.CVE-2023-3518 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.4
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Aug 2, 2023Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary sCVE-2023-33371 · Other software · Assaabloy · reported by MITRECritical 9.8
Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
- Product
- Control ID Idsecure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comcontrolid.com.br
Jul 19, 2023 Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.CVE-2023-35134 · Other software · Weintek · reported by ics-cert@hq.dhs.govHigh 7.4
Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.
- Product
- Weincloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023 Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.CVE-2023-34429 · Other software · Weintek · reported by ics-cert@hq.dhs.govHigh 7.5
Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.
- Product
- Weincloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing.CVE-2023-26089 · Other software · Echa.europa · reported by MITRECritical 9.8
European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5.
- Product
- Iuclid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiuclid6.echa.europa.euiuclid6.echa.europa.eu
Feb 17, 2023Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.CVE-2021-32163 · Computers, phones & browsers · Linuxfoundation · reported by MITRECritical 9.8
Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.
- Product
- Modular Open Smart Network
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user.CVE-2021-4314 · Other software · Open Mainframe Project · reported by zowe-security@lists.openmainframeproject.orgMedium 5.3
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the services using the ZAAS client or the API ML API to query will be deceived into believing the information in the JWT token is valid when it isn’t. It’s possible to use this to persuade the southbound service that different user is authenticated.
- Product
- Zowe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Token validation methods are susceptible to a timing side-channel during HMAC comparison.CVE-2015-10004 · Other software · github.com/robbert229/jwt · reported by security@golang.orgHigh 7.5
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
- Product
- github.com/robbert229/jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaCVE-2022-23540 · Other software · auth0 · reported by GitHubMedium 6.4
In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.
- Product
- node-jsonwebtoken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.CVE-2022-42983 · Other software · Anji-plus · reported by MITREHigh 8.8
anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.
- Product
- Aj-report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.CVE-2022-42980 · Other software · Go-admin · reported by MITRECritical 9.8
go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.
- Product
- Go-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022python-jwt is a module for generating and verifying JSON Web Tokens.CVE-2022-39227 · Other software · davedoesdev · reported by GitHubCritical 9.1
python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds.
- Product
- python-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertiCVE-2021-41803 · Other software · Hashicorp · reported by MITREHigh 7.1
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comlists.fedoraproject.org
Sep 7, 2022JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers,CVE-2022-36083 · Other software · panva · reported by GitHubMedium 5.3
JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. Under certain conditions, it is possible to have the user's environment consume unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `
- Product
- jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file.CVE-2022-36672 · Other software · Xxyopen · reported by MITRECritical 9.8
Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.CVE-2022-35540 · Other software · Dotnetcore · reported by MITRECritical 9.8
Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.
- Product
- Agileconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.