| Package | Affected versions | Patched versions |
|---|---|---|
| azure active directory passport | = 1.0.0= 1.1.0= 1.1.1= 1.2.0= 1.3.0= 1.3.1= 1.3.2= 1.3.3= 1.3.4= 1.3.5= 1.3.6= 1.4.0= 1.4.1= 1.4.2= 1.4.3= 1.4.4= 1.4.5= 2.0.0 | |
| passport-azure-ad | ≥ 1.0.0, < 1.4.6≥ 2.0.0, < 2.0.1 | 1.4.62.0.1 |
Affected versions of passport-azure-ad do not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
Version 1.x: Update to version 1.4.6 or later. Version 2.x: Update to version 2.0.1 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free