Unrestricted Key Type

2022-12-2307:07:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

jsonwebtoken

vulnerability

bypass

signature

verification

remote attacker

misconfigured

insecure

key types

algorithm

affected

software

EPSS

0.001

Percentile

41.7%

JSON

jsonwebtoken uses unrestricted key type. A remote attacker is able to bypass signature verification if the library is misconfigured so that legacy, insecure key types are used for the verification. The user is affected if the library uses an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected.