CVE-2016-10555

Description

Affected versions of the `jwt-simple` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the end result is a complete authentication bypass with minimal effort. ## Recommendation Update to version 0.3.1 or later. Additionally, be sure to always specify an algorithm in calls to `.decode()`.

How to fix CVE-2016-10555

To remediate CVE-2016-10555, upgrade the affected package to a fixed version below.

• —upgrade to 0.3.1 or later

Is CVE-2016-10555 being exploited?

Likely — EPSS is 81.7%, placing CVE-2016-10555 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (1)

• from 0, < 0.3.1

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2016-10555
• WEBauth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
• WEBgithub.com/hokaccha/node-jwt-simple/commit/957957cfa44474049b4603b293569588ee9ffd97
• WEBgithub.com/hokaccha/node-jwt-simple/pull/14