Vulnerability Database
289,599
Total vulnerabilities in the database
CVE-2016-1000223
Affected versions of the jws package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer token, the end result is a complete authentication bypass with minimal effort.
Recommendation
Update to version 3.0.0 or later.
| Software | From | Fixed in |
|---|---|---|
brianloveswords / jws
|
- | 3.0.0 |