jsonwebtoken — Insecure JWT Secret Handling

NVD Description

jsonwebtoken before 9.0.0 can be bypassed by a malicious actor if the secretOrPublicKey can be controlled. An attacker could forge a JWT token and pass verification when the key can be set to an object with a toString function.

Affected Packages (1)

Public Exploits & PoCs3 found