Authentication Bypass Vulnerability in hapi-auth-jwt2 by dwyl
CVE-2016-10525

9.8CRITICAL

Key Information:

Vendor

Hackerone

Status
Hapi-auth-jwt2 Node Module
Vendor
CVE Published:
29 May 2018

What is CVE-2016-10525?

A flaw in hapi-auth-jwt2 version 5.1.1 allows attackers to bypass authentication when the authentication mode is set to 'try'. This vulnerability poses security risks by potentially allowing unauthorized users to access protected resources without valid credentials.

Affected Version(s)

hapi-auth-jwt2 node module 5.1.1

References

https://nodesecurity.io/advisories/81
x_refsource_MISC
https://github.com/dwyl/hapi-auth-jwt2/pull/112
x_refsource_MISC
https://github.com/dwyl/hapi-auth-jwt2/issues/111
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.