A critical security vulnerability has been discovered in two of the most widely-used JWT libraries: jsonwebtoken (npm) and jose (npm), collectively downloaded over 50 million times per week. The flaw allows attackers to completely bypass authentication systems.
The Vulnerability Explained
The issue stems from algorithm confusion attacks where malicious actors can manipulate JWT tokens to use weaker signing algorithms than intended.
How it works:
- Application expects RS256 (RSA with SHA-256)
- Attacker modifies token header to use HS256 (HMAC with SHA-256)
- Attacker signs token using the public key as HMAC secret
- Server validates token successfully, granting unauthorized access
Affected Versions
jsonwebtoken
