GitHub Advisoryadvisory · npm

GHSA-v66p-w7qx-wv98 Authentication Bypass in express-laravel-passport

CRITICAL Published 2020-09-04 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
express-laravel-passport
Severity
Critical
Weaknesses
CWE-287
Reviewed
2020-08-31

Affected packages

• npm express-laravel-passport: >= 0.0.0 (no fix yet)

Description

All versions of `express-laravel-passport` are vulnerable to an Authentication Bypass. The package fails to properly validate JWTs, allowing attackers to send HTTP requests impersonating other users. Recommendation Upgrade to version 2.0.5 or later.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References