Vulnerabilityhigh
Security Issue in JWT Secret Poisoning (Updated)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-23529 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER | — | — |
From the original article
8 min read at unit42.paloaltonetworks.com
After hearing the community's feedback about the prerequisites of the exploitation scenario of the vulnerability, we made the decision to work with Auth0 to retract CVE-2022-23529. The security issue described in this blog remains a concern when the JsonWebToken library is used in an insecure way. In that scenario, if all the prerequisites are met, the issue may be exploitable.
By Artur Oleyarsh · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.