Executive brief
This advisory has been withdrawn as a duplicate. The vulnerability affected jwt-simple, a JavaScript library used to encode and decode JSON Web Tokens (JWTs). The original issue involved an algorithm confusion weakness in the token verification process that could allow attackers to bypass signature validation under certain conditions.
Technical details
The vulnerability involved improper algorithm handling in the JWT decode/verification method. The library initially did not properly enforce or validate the algorithm parameter during token verification, potentially allowing an attacker to specify or override the algorithm used for signature validation. This advisory was withdrawn as a duplicate of GHSA-vgrx-w6rg-8fqf, indicating the same issue was tracked elsewhere. The fix involved adding an explicit algorithm parameter to the decode method that overrides the token's embedded algorithm specification and performs verification with the specified algorithm.
Affected products
- hokaccha node-jwt-simple before 0.3.1
Timeline
- 2020-08-03: disclosed
- other: Advisory withdrawn as duplicate of GHSA-vgrx-w6rg-8fqf