Authentication Bypass in hapi-auth-jwt2

Description

Versions of hapi-auth-jwt2 prior to version 5.1.2 are affected by a complete authentication bypass vulnerability when in the try authentication mode.

Recommendation

Update the hapi-auth-jwt2 package to the latest compatible version. Followings are version details:

• Affected version(s): = 5.1.1
• Patched version(s): 5.1.2

References

• GHSA-mg8r-9g6j-hwv9
• www.npmjs.com
• CVE-2016-10525
• CWE-287
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• tarteaucitron Cross-site Scripting (XSS) - CVE-2025-1467
• Cross site scripting in markdown-to-jsx - CVE-2024-21535
• uPlot Prototype Pollution vulnerability - CVE-2024-21489
• FUXA local file inclusion vulnerability - CVE-2023-31718

Tags:

npm

hapi-auth-jwt2