@microservice/auth-token@2.0.0

Vulnerabilities

 1 via 1 paths

Dependencies

 3

Source

 npm
Find a vulnerability free version of @microservice/auth-token | View @microservice/auth-token package health on Snyk Advisor

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity

Signature Verification Bypass

  • Vulnerable module: jwt-simple
  • Introduced through: jwt-simple@0.3.1

Detailed paths

  • Introduced through: @microservice/auth-token@2.0.0 › jwt-simple@0.3.1
    Remediation: Upgrade to jwt-simple@0.5.3.

Overview

jwt-simple is a JWT(JSON Web Token) encode and decode module.

Affected versions of this package are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode() function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).

Remediation

Upgrade jwt-simple to version 0.5.3 or higher.

References

Signature Verification Bypass vulnerability report