GHSA-r2vw-jgq9-jqx2
Improper Authorization in @sap-cloud-sdk/core
GHSA-r2vw-jgq9-jqx2 is a vulnerability with no CVSS score yet in @sap-cloud-sdk/core, published September 3, 2020. No source lists public exploit code. Fixed in @sap-cloud-sdk/core 1.21.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.21.2@sap-cloud-sdk/core
Description
Affected versions of @sap-cloud-sdk/core do not properly validate JWTs. The verifyJwt() function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.
Recommendation
Upgrade to version 1.21.2 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@sap-cloud-sdk/corenpm | 1.19.0 up to 1.21.2 | 1.21.2 |
What each source reports
GitHub AdvisoriesNo score
Improper Authorization in @sap-cloud-sdk/core
Affected versions of @sap-cloud-sdk/core do not properly validate JWTs. The verifyJwt() function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.
Recommendation
Upgrade to version 1.21.2 or later.
- Record
GHSA-r2vw-jgq9-jqx2- Weakness
- CWE-285
- Updated
- 2026-11-02
OSVNo score
Improper Authorization in @sap-cloud-sdk/core
Affected versions of @sap-cloud-sdk/core do not properly validate JWTs. The verifyJwt() function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.
Recommendation
Upgrade to version 1.21.2 or later.
- Record
GHSA-r2vw-jgq9-jqx2- Weakness
- CWE-285
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.