Jwt
Monthly
Improper authorization in Hono's JWT Auth Middleware (hono/jwt in the npm package 'hono', versions 1.1.0 through 4.10.1) causes the API to accept a correctly signed token that was issued for a different audience, producing confused-deputy / token-mix-up behavior whenever multiple services share the same JWT issuer and signing key. Because the middleware exposed no aud verification option at all before 4.10.2 (documented options covered only iss/nbf/iat/exp), any such shared-key deployment was left unvalidated by default with no misconfiguration required; however, the attacker must already possess a valid, correctly signed token minted for another audience in the same trust domain, and a multi-service shared-key architecture must exist, so a fully anonymous outsider cannot exploit it. Public reporting is limited to the vendor GitHub advisory (which deliberately withholds reproduction steps) and the upstream fix commit, the EPSS score is low at 0.38% (30th percentile), there is no CISA KEV listing, and the vendor-released patch is Hono 4.10.2. Signals are mixed and point to a conditional, moderate real-world priority rather than a drop-everything emergency.
JWT is a library to work with JSON Web Token and JSON Web Signature. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.
The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authorization in Hono's JWT Auth Middleware (hono/jwt in the npm package 'hono', versions 1.1.0 through 4.10.1) causes the API to accept a correctly signed token that was issued for a different audience, producing confused-deputy / token-mix-up behavior whenever multiple services share the same JWT issuer and signing key. Because the middleware exposed no aud verification option at all before 4.10.2 (documented options covered only iss/nbf/iat/exp), any such shared-key deployment was left unvalidated by default with no misconfiguration required; however, the attacker must already possess a valid, correctly signed token minted for another audience in the same trust domain, and a multi-service shared-key architecture must exist, so a fully anonymous outsider cannot exploit it. Public reporting is limited to the vendor GitHub advisory (which deliberately withholds reproduction steps) and the upstream fix commit, the EPSS score is low at 0.38% (30th percentile), there is no CISA KEV listing, and the vendor-released patch is Hono 4.10.2. Signals are mixed and point to a conditional, moderate real-world priority rather than a drop-everything emergency.
JWT is a library to work with JSON Web Token and JSON Web Signature. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.
The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.