kjur/jsrsasign

JWS and JWT signature validation with \

OrKiTheGitter opened this issue · 3 comments

OrKiTheGitter commented

Hello,

jsrsasign supports JWS(JSON Web Signatures) and JWT(JSON Web Token) validation. However JWS or JWT signature or header with non Base64URL encoding \ may be valid.

For example, even if a string of non-Base64URL encoding characters such as \ is inserted into a valid JWS or JWT signature, payload and header will still be a valid JWS or JWT.

When jsrsasign's JWS or JWT validation is used in OpenID connect or OAuth2, this vulnerability will affect authentication or authorization.

PoC sent privately

kjur commented

Thank you for your report. I'll check it.

OrKiTheGitter commented

Thanks, Can be closed :)

  • 👍1
kjur commented

Hi all, @OrKiTheGitter and I have confirmed and agreed that this is not a vulnerability.