CVE-2023-31580: Medium severity lightoauth2 vulnerability
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-31580?
CVE-2023-31580 is a vulnerability in the light-oauth2 library that allows attackers to authenticate to the application with a crafted JWT token.
What is the severity of CVE-2023-31580?
The severity of CVE-2023-31580 is medium with a CVSS score of 5.9.
How can I verify the version of light-oauth2 installed in my application?
You can verify the version of light-oauth2 installed in your application by checking the dependency or package management system.
How do I fix CVE-2023-31580?
To fix CVE-2023-31580, upgrade the light-oauth2 library to version 2.1.27 or higher.
Where can I find more information about CVE-2023-31580?
You can find more information about CVE-2023-31580 in the references provided: [GitHub](https://github.com/KANIXB/JWTIssues/blob/main/Certification%20Verification%20issue%20in%20light-oauth2.md), [GitHub Issues](https://github.com/networknt/light-oauth2/issues/369), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-31580).