Signature Verification Bypass Affecting jwt-simple package, versions <0.5.3



    Attack Complexity Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-JWTSIMPLE-174523
  • published 25 Apr 2019
  • disclosed 24 Apr 2019
  • credit Daniel Gunawan

Introduced: 24 Apr 2019

CVE NOT AVAILABLE CWE-358 Open this link in a new tab

How to fix?

Upgrade jwt-simple to version 0.5.3 or higher.


jwt-simple is a JWT(JSON Web Token) encode and decode module.

Affected versions of this package are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode() function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).