What is GHSA-v66p-w7qx-wv98?

GHSA-v66p-w7qx-wv98 is a security advisory published by GitHub Security Advisories with Critical severity. Authentication Bypass in express-laravel-passport

Why does GHSA-v66p-w7qx-wv98 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-v66p-w7qx-wv98?

GHSA-v66p-w7qx-wv98 affects 1 product, including: npm/express-laravel-passport:\u003e= 0.0.0.

GHSA-v66p-w7qx-wv98CriticalDisclosed before NVD

Authentication Bypass in express-laravel-passport

Vendor

GitHub Security Advisories

Published

September 4, 2020

Last Modified

January 9, 2023

📋 Description

All versions of express-laravel-passport are vulnerable to an Authentication Bypass. The package fails to properly validate JWTs, allowing attackers to send HTTP requests impersonating other users.

Recommendation

Upgrade to version 2.0.5 or later.

🎯 Affected products1

npm/express-laravel-passport:>= 0.0.0

🔗 References (3)

https://hackerone.com/reports/748214
https://www.npmjs.com/advisories/1450
https://github.com/advisories/GHSA-v66p-w7qx-wv98