Описание
Authentication Bypass in hapi-auth-jwt2
Versions of hapi-auth-jwt2 prior to version 5.1.2 are affected by a complete authentication bypass vulnerability when in the try authentication mode.
Recommendation
Update to version 5.1.2 or later.
Пакеты
Наименование
hapi-auth-jwt2
npm
Затронутые версииВерсия исправления
= 5.1.1
5.1.2
Связанные уязвимости
CVSS3: 9.8
nvd
больше 7 лет назад
When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.