Skip to content
OpenAdvisories

Product · HackerOne

jsonwebtoken node module

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical —
    CVE-2015-9235 Public exploit

    Verification Bypass in jsonwebtoken

    In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm …

    HackerOne jsonwebtoken node module jsonwebtoken npm