CVE-2016-10525

When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.

Score

CVSS 3.0 9.8 Critical

Status

Modified - support@hackerone.com

Published

2018-05-29

Last modified

2024-09-17

Weaknesses

CWE-287

Affected products

• Hapi-auth-jwt2 (Dwyl)
• Hapi-auth-jwt2 Node Module (Hackerone)

References

• https://github.com/dwyl/hapi-auth-jwt2/issues/111
• https://github.com/dwyl/hapi-auth-jwt2/pull/112
• https://nodesecurity.io/advisories/81