Home / Vulnerability Database / Kotlin : Unsafe JWT-token verification
Kotlin
Kotlin : Unsafe JWT-token verification
Classification
OWASP Top 10 2013
OWASP Top 10 2017
OWASP Top 10 2021
PCI DSS 4.0
CWE
Overview
An unsafe way of verifying the JWT-token is used.
DefaultJwtParser method from io.jsonwebtoken.impl package verifies the token only if there is a signature. If a token without a signature is passed, the verification step will be skipped. This can lead to token tampering and leakage of confidential data.
MEDIUM
DerScanner Severity Score
Do you want to fix Kotlin : Unsafe JWT-token verification in your application?
See also
Kotlin
Kotlin : Missing required cryptographic step
Kotlin
Kotlin : Logging into system output
Kotlin