Lucene search
GoogleOSV:GHSA-2H3H-VW8R-82RPHistoryMar 26, 2021 - 4:49 p.m.
Weak JSON Web Token in yapi-vendor
2021-03-2616:49:26
Google
osv.dev
10
weak jwt
yapi-vendor
cryptographically secure.
EPSS
0.001
Percentile
27.1%
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users’ JWT tokens. This occurs because Math.random in Node.js is used as a source of randomness in jwt signing. Math.random does not provide cryptographically secure random numbers. This has been patched in version 1.9.3.
Related
osv
osv
CVE-2021-27884
2021-03-01 23:15:13
cvelist
cvelist
CVE-2021-27884
2021-03-01 23:00:51
nvd
nvd
CVE-2021-27884
2021-03-01 23:15:13
github
github
Weak JSON Web Token in yapi-vendor
2021-03-26 16:49:26
veracode
veracode
Insecure Random Number Generator
2021-03-29 03:56:45
prion
prion
Code injection
2021-03-01 23:15:00
cve
cve
CVE-2021-27884
2021-03-01 23:15:13