Skip to content
OpenAdvisories

Product · HackerOne

jwt-simple node module

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical —
    CVE-2016-10555 Public exploit

    Forgeable Public/Private Tokens in jwt-simple

    Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the publ…

    HackerOne jwt-simple node module jwt-simple npm