Skip to content

Signature Verification Bypass in jwt-simple

High severity GitHub Reviewed Published Jun 6, 2019 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm jwt-simple (npm)

Affected versions

< 0.5.3

Patched versions

0.5.3

Description

Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode() function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).

Recommendation

Upgrade to version 0.5.3 or later.

References

Reviewed Jun 6, 2019
Published to the GitHub Advisory Database Jun 6, 2019
Last updated Jan 9, 2023

Severity

High

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-8v5f-hp78-jgxq

Source code

No known source code
Checking history
See something to contribute? Suggest improvements for this vulnerability.