crumb@3.0.0 vulnerabilities

CSRF crumb generation and validation plugin

Direct Vulnerabilities

Known vulnerabilities in the crumb package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Authentication Bypass

crumb is CSRF crumb generation and validation plugin.

Affected versions of the package are vulnerable to Authentication Bypass. crumb does not validate the hostname while comparing a request origin against the whitelist, but rather compare http protocol alone. This opens a window for attackers to gain information by Man in the Middle (MitM) attacks.

How to fix Authentication Bypass?

Upgrade crumb to version 4.0.2 or higher.