GHSA-45fh-g845-pj9w
Auth0 Passport-SharePoint does not validate JWT signature
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | passport-sharepoint | < 0.4.0 | 0.4.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
References
External links from the advisory. They lead to third-party sites.