In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
The product uses a broken or risky cryptographic algorithm or protocol.
| Link | Tags |
|---|---|
| https://nodesecurity.io/advisories/17 | third party advisory |
| https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687 | third party advisory patch |
| https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ | broken link vendor advisory |
| https://www.timmclean.net/2015/02/25/jwt-alg-none.html | third party advisory exploit |