Skip to content
Threat Feed
Subscribe

Product

Fast-Jwt (<= 6.3.0)

1 brief RSS
high advisory

Authentication Bypass in fast-jwt via Unsigned JWT Processing

The fast-jwt library (<= 6.3.0) fails to verify JWT signatures when the 'key' configuration is falsy and 'algorithms' are explicitly defined, allowing unauthenticated attackers to forge arbitrary claims.

fast-jwt authentication-bypass jwt-vulnerability software-supply-chain
1t 1c