Description
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.networknt:light-oauth2 | < 2.1.27 | 2.1.27 | GHSA-mx47-h5fv-ghwh |