Authentication Bypass in hapi-auth-jwt2

Description

Versions of hapi-auth-jwt2 prior to version 5.1.2 are affected by a complete authentication bypass vulnerability when in the try authentication mode.

Recommendation

Update the hapi-auth-jwt2 package to the latest compatible version. Followings are version details:

• Affected version(s): = 5.1.1
• Patched version(s): 5.1.2

References

• GHSA-mg8r-9g6j-hwv9
• www.npmjs.com
• CVE-2016-10525
• CWE-287
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Authentication bypass vulnerability in Apple Game Center auth adapter - CVE-2022-31083
• Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter - CVE-2022-24901
• Authentication Bypass in console-io - CVE-2016-10532
• Sanitization bypass using HTML Entities in marked - CVE-2016-10531

Tags:

npm

hapi-auth-jwt2