CVE-2019-13483

Auth0 Passport-SharePoint does not validate JWT signature

7.3 HighFix available

CVE-2019-13483 is a high vulnerability (CVSS 7.3) in Auth0 Passport-sharepoint, published July 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in passport-sharepoint 0.4.0.

Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.56%Up 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 7.3

Record: CVE-2019-13483
CVSS 3.0: 7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-345
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-13483
Updated: 2026-11-02

EUVDEUVD-2022-2304 No score

Record: EUVD-2022-2304
Updated: 2026-11-03

GitHub AdvisoriesGHSA-45fh-g845-pj9w 7.3

Auth0 Passport-SharePoint does not validate JWT signature

Record: GHSA-45fh-g845-pj9w
CVSS 3.0: 7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-345
Updated: 2026-11-02

OSV 7.3

Record: CVE-2019-13483
CVSS 3.0: 7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVGHSA-45fh-g845-pj9w 7.3