Description
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| filebrowser | filebrowser | 2.50.0 – ≤ 2.63.21 | — |
References
- GitHub Security Advisory (GHSA-v3jv-rmh2-635j) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass third-party-advisory