Description
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.
Remediation
References
https://github.com/KANIXB/JWTIssues/blob/main/Certification%20Verification%20issue%20in%20light-oauth2.md
https://github.com/networknt/light-oauth2/issues/369
Related Vulnerabilities
CVE-2022-31367 Vulnerability in npm package @strapi/strapi
CVE-2021-43090 Vulnerability in maven package com.predic8:soa-model-core
CVE-2010-0684 Vulnerability in maven package org.apache.activemq:activemq-web
CVE-2023-36478 Vulnerability in maven package org.eclipse.jetty.http3:http3-qpack
CVE-2020-14968 Vulnerability in maven package org.webjars.bower:jsrsasign