medium5.9
CVE-2023-31580
light-oauth2 missing public key verification
Impact
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.networknt:light-oauth2 | < 2.1.27 | 2.1.27 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Networknt | Light-Oauth2 | before 2.1.27 |