GHSA-8v5f-hp78-jgxq
Signature Verification Bypass in jwt-simple
GHSA-8v5f-hp78-jgxq is a vulnerability with no CVSS score yet in jwt-simple, published June 6, 2019. No source lists public exploit code. Fixed in jwt-simple 0.5.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.5.3jwt-simple +1 more
Description
Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode() function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).
Recommendation
Upgrade to version 0.5.3 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jwt-simplenpm | before 0.5.3 | 0.5.3 |
jwt-simpleTuxCare:npm | 0.3.1-tuxcare.0 up to 0.3.1-tuxcare.1, plus listed versions 0.3.1 | 0.3.1-tuxcare.1 |
What each source reports
GitHub AdvisoriesNo score
Signature Verification Bypass in jwt-simple
Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode() function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).
Recommendation
Upgrade to version 0.5.3 or later.
- Record
GHSA-8v5f-hp78-jgxq- Weakness
- CWE-347
- Updated
- 2026-11-02
OSVCLSA-2026-1789068227No score
TuxCare security update for jwt-simple (1 CVE)
TuxCare rebuilt jwt-simple to address 1 CVE. Fixed in 0.3.1-tuxcare.1.
- Record
CLSA-2026-1789068227- Updated
- 2026-11-02
OSVNo score
Signature Verification Bypass in jwt-simple
Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode() function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).
Recommendation
Upgrade to version 0.5.3 or later.
- Record
GHSA-8v5f-hp78-jgxq- Weakness
- CWE-347
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.