CVE-2016-10525: Authentication Bypass in hapi-auth-jwt2
Summary
CVE-2016-10525: Authentication Bypass in hapi-auth-jwt2. Affects hapi-auth-jwt2 versions >= 5.1.1, < 5.1.2. Fixed in 5.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hapi-auth-jwt2 package is an npm package used for authentication in hapi.js applications. It provides JSON Web Token (JWT) authentication strategies for securing routes. The package allows developers to implement authentication using JWT tokens, which are commonly used for stateless authentication in web applications. However, versions prior to 5.1.2 of hapi-auth-jwt2 are affected by a critical vulnerability that allows complete authentication bypass when in the try authentication mode.
Vulnerability Detail
The vulnerability in hapi-auth-jwt2 arises from a flaw in the try authentication mode. This mode allows the authentication strategy to be used as a fallback when other strategies fail. However, due to a coding error, the try mode in affected versions of hapi-auth-jwt2 does not properly handle authentication failures, resulting in an authentication bypass. An attacker can exploit this vulnerability to gain unauthorized access to protected resources without a valid JWT token. This can lead to unauthorized data access, privilege escalation, and other security breaches.
How To Fix
Minimum fixed version
5.1.2
This is the first release that contains the fix.
npm install hapi-auth-jwt2@5.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The hapi-auth-jwt2 package prior to version 5.1.2 is affected by a critical authentication bypass vulnerability. It is crucial to update to version 5.1.2 or later to mitigate the risk of unauthorized access and potential security breaches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hapi-auth-jwt2 →
FAQ
The vulnerability allows an attacker to bypass authentication and gain unauthorized access to protected resources. This can lead to data breaches, privilege escalation, and other security issues.
Versions prior to 5.1.2 of hapi-auth-jwt2 are affected by this vulnerability.
No, the recommended solution is to update to version 5.1.2 or later of hapi-auth-jwt2.
There are no known exploits for this vulnerability at this time.
You can find more information about this vulnerability in the GitHub Security Advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-mg8r-9g6j-hwv9/GHSA-mg8r-9g6j-hwv9.json
