CVE-2015-9235

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions 4.2.1 and earlier

Description The issue allows an attacker to bypass verification when a token digitally signed with an asymmetric key is sent, but the attacker instead sends a token digitally signed with a symmetric algorithm. This is due to weak validation of the JWT algorithm type, which occurs when an attacker is allowed to arbitrarily specify the JWT algorithm.

Recommendations Update to version 4.2.2 or later.