Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
New JWT lab just dropped. Inspired by CVE-2019-7644: JWT signature leak. Try it here: https://pentesterlab.com/exercises/jwt-signature-leak
Post summary
A new pentesterlab exercise demonstrates the JWT signature leak CVE‑2019‑7644, serving as a proof‑of‑concept for educational purposes.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | auth0 | auth0-wcf-service-jwt | - | - | - |