Vulnerability	Vulnerable Version
C Improper Authentication fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Authentication in the async key resolver when it returns an empty string or zero-length buffer. An attacker can gain unauthorized access and assume arbitrary identities by forging JWTs signed with an empty secret, which are then accepted as valid tokens. Note: This is only exploitable if the application uses an asynchronous callback for key resolution and the callback can return an empty string or zero-length buffer, while HMAC algorithms are allowed (default configuration). How to fix Improper Authentication? Upgrade `fast-jwt` to version 6.2.4 or higher.	<6.2.4

Improper Authentication

fast-jwt is a Fast JSON Web Token implementation

Affected versions of this package are vulnerable to Improper Authentication in the async key resolver when it returns an empty string or zero-length buffer. An attacker can gain unauthorized access and assume arbitrary identities by forging JWTs signed with an empty secret, which are then accepted as valid tokens.

Note: This is only exploitable if the application uses an asynchronous callback for key resolution and the callback can return an empty string or zero-length buffer, while HMAC algorithms are allowed (default configuration).

How to fix Improper Authentication?

Upgrade fast-jwt to version 6.2.4 or higher.

<6.2.4

Go back to all versions of this package