CVE-2015-9235 Verification Bypass in jsonwebtoken
CriticalCVSS 9.8
EPSS 8.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm jsonwebtoken(npm) | < 4.2.2 | 4.2.2 |
| auth0 jsonwebtoken | < 4.2.2 | 4.2.2 |
| HackerOne jsonwebtoken node module | = <4.2.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com patch third-party-advisory
- auth0.com broken-link vendor-advisory
- github.com
- www.npmjs.com
- www.timmclean.net exploit third-party-advisory
- nodesecurity.io third-party-advisory