GHSA-mx47-h5fv-ghwh

light-oauth2 missing public key verification

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-31580

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.networknt:light-oauth2	< 2.1.27	2.1.27

Details

As written in the advisory (Markdown source, shown as plain text).

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-31580 advisory
https://github.com/networknt/light-oauth2/issues/369 web
https://github.com/KANIXB/JWTIssues/blob/main/Certification%20Verification%20issue%20in%20light-oauth2.md web
https://github.com/networknt/light-oauth2 package