Jwt Simple Project

jwt-simple_project

1 CVE • 1 product

Products (1)

Click to collapse

Toggle

Jwt Simple

jwt-simple

1 CVE

CVEs (1)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-10555 1Jwt Simple Project 1Jwt Simple Nov 21, 2024 May 31, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's pub...Show more Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.Show less

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2016-10555

1Jwt Simple Project

1Jwt Simple

Nov 21, 2024

May 31, 2018

N/A· v4

6.5 MEDIUM· v3

4.0 MEDIUM· v2

Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.Show less