CVE-2017-10862

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token.

Score

CVSS 3.0 5.3 Medium

Status

Modified - vultures@jpcert.or.jp

Published

2017-10-12

Last modified

2024-08-05

Weaknesses

CWE-345

Affected products

• Jwt-scala (Really)
• Jwt-scala (Reallyl Io)

References

• https://github.com/reallylabs/jwt-scala
• https://jvn.jp/en/vu/JVNVU90916766/index.html