Skip to content

Product

auth0 express-jwt vulnerabilities

1 published CVE affecting auth0 express-jwt, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
1
High
0
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest auth0 express-jwt CVEs

Newest publication first

  1. CVE-2020-15084 Authorization bypass in express-jwt

    Published
    CriticalCVSS 9.1 EPSS 1.2%

    In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.