CVE-2024-33531

Name of the Vulnerable Software and Affected Versions lua-resty-jwt version 0.2.3

Description The issue allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM. This enables them to potentially access unauthorized resources or perform malicious actions.

Recommendations For lua-resty-jwt version 0.2.3, as a temporary workaround, consider restricting the use of the enc header or validating its value to prevent it from being set to A256GCM until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.