Name of the Vulnerable Software and Affected Versions @sap-cloud-sdk/core versions prior to 1.21.2

Description The issue concerns improper validation of JWTs in the affected software. Specifically, the verifyJwt() function does not correctly validate the URL from which the public verification key for the JWT is downloaded, trusting any provided URL. This makes it possible to manipulate the JWT by providing a URL belonging to it.

Recommendations Upgrade to version 1.21.2 or later.