In short
- CVE-2015-9235 is a CRITICAL (CVSS 9.8) vulnerability affecting jsonwebtoken (auth0), jsonwebtoken.
- Chance of exploitation in the next 30 days (EPSS): 8.5%, higher than 95.0% of all vulnerabilities.
- Fix: update to 4.2.2 or later.
Description
Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.
Recommendation
Update to version 4.2.2 or later.
NVD description
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
More vulnerabilities in jsonwebtoken
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free