CVE-2016-10525 - When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication

Back Back to CVE browser

CRITICAL

When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication

Published May 29, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 2.48%

Description

When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.

Affected products

Vendor HackerOne Product Hapi-Auth-Jwt2 Node Module Default
n/a
- Version
  5.1.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

HackerOne

Hapi-Auth-Jwt2 Node Module

n/a

Version	Status	Constraints
5.1.1	affected	-

Ecosystem	Package	Introduced	Fixed
npm	hapi-auth-jwt2	5.1.1	5.1.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (6)

https://github.com/advisories/GHSA-mg8r-9g6j-hwv9
Advisory
https://github.com/dwyl/hapi-auth-jwt2/issues/111
x_refsource_MISCPatchThird Party Advisory
https://github.com/dwyl/hapi-auth-jwt2/pull/112
x_refsource_MISCThird Party Advisory
https://nodesecurity.io/advisories/81
x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-10525
https://www.npmjs.com/advisories/81

Link	Providers	Tags
https://github.com/advisories/GHSA-mg8r-9g6j-hwv9		Advisory
https://github.com/dwyl/hapi-auth-jwt2/issues/111		x_refsource_MISCPatchThird Party Advisory
https://github.com/dwyl/hapi-auth-jwt2/pull/112		x_refsource_MISCThird Party Advisory
https://nodesecurity.io/advisories/81		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-10525
https://www.npmjs.com/advisories/81