Authentication Bypass Affecting crumb package, versions <4.0.2



    Attack Complexity Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID npm:crumb:20150213
  • published 21 Jun 2017
  • disclosed 12 Feb 2015
  • credit Nicolas Jessel

Introduced: 12 Feb 2015

CVE NOT AVAILABLE CWE-592 Open this link in a new tab

How to fix?

Upgrade crumb to version 4.0.2 or higher.


crumb is CSRF crumb generation and validation plugin.

Affected versions of the package are vulnerable to Authentication Bypass. crumb does not validate the hostname while comparing a request origin against the whitelist, but rather compare http protocol alone. This opens a window for attackers to gain information by Man in the Middle (MitM) attacks.