Public Key Verification Flaw in light-oauth2 by NetworkNT
CVE-2023-31580

5.9MEDIUM

Key Information:

Vendor

Networknt

Status
Light-oauth2
Vendor
CVE Published:
25 October 2023

What is CVE-2023-31580?

The light-oauth2 library, prior to version 2.1.27, contains a vulnerability that permits the acquisition of the public key without proper authentication checks. This oversight can be exploited by attackers to submit a specially crafted JWT token, potentially gaining unauthorized access to the application.

References

https://github.com/networknt/light-oauth2/issues/369
https://github.com/KANIXB/JWTIssues/blob/main/Certificati...

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.