Description
jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| reallyl IO | jwt-scala | 1.2.2 and earlier | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.really:jwt-scala | <= 1.2.2 | — | GHSA-9pxm-8g95-q5xr |