Skip to main content

Authentication Bypass by Assumed-Immutable Data in jws

CVE-2016-1000223

  • jws
High
7.1/10

Summary

jws before 3.0.0 allows users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer token, the end result is a complete authentication bypass with minimal effort.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-302 - Authentication Bypass by Assumed-Immutable Data

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

References

Advisory Timeline

  • Published