Skip to content
OpenAdvisories

Package · npm

jwt-simple

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-8v5f-hp78-jgxq

    Signature Verification Bypass in jwt-simple

    Versions of `jwt-simple` prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the `decode()` function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric…

    jwt-simple npm
  • Critical —
    CVE-2016-10555 Public exploit

    Forgeable Public/Private Tokens in jwt-simple

    Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the publ…

    HackerOne jwt-simple node module jwt-simple npm