GitHub Advisoryadvisory · npm
GHSA-mg8r-9g6j-hwv9 Authentication Bypass in hapi-auth-jwt2
CRITICAL
Official page ↗
- Aliases
- CVE-2016-10525
- Ecosystem
- npm
- Packages
- hapi-auth-jwt2
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-287
- Reviewed
- 2020-06-16
Affected packages
• npm hapi-auth-jwt2: >= 5.1.1, < 5.1.2 → fixed in 5.1.2
Description
Versions of `hapi-auth-jwt2` prior to version 5.1.2 are affected by a complete authentication bypass vulnerability when in the `try` authentication mode.
Recommendation
Update to version 5.1.2 or later.
Related
Alias · CVE (1)
- CVE-2016-10525 When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass… vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-10525 advisory
- https://github.com/dwyl/hapi-auth-jwt2/issues/111 web
- https://github.com/dwyl/hapi-auth-jwt2/pull/112 web
- https://github.com/advisories/GHSA-mg8r-9g6j-hwv9 advisory
- https://github.com/dwyl/hapi-auth-jwt2 package
- https://www.npmjs.com/advisories/81 web