Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Regression in JWT Signature Validation
Vulnerability Description
omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all of the following conditions apply: 1. You are using `omniauth-auth0`. 2. You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDK’s default Authorization Code Flow. The issue is patched in version 2.4.1.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability Type
认证机制不恰当
Vulnerability Title
Auth0 omniauth-auth0 数据伪造问题漏洞
Vulnerability Description
Auth0 omniauth-auth0是美国Auth0公司的一个应用于Oauth认证的Ruby代码库。 omniautho-auth0 (rubygems) 2.3.0 版本至2.4.1版本之前存在数据伪造问题漏洞，该漏洞源于在使用“JWT验证器”时不正确地验证JWT令牌签名。攻击者可利用该漏洞绕过身份验证和授权。
CVSS Information
N/A
Vulnerability Type
N/A