What’s Vulnerable › Vulnerabilities

CVE-2017-18239

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-18 · updated 2026-06-17

Description

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.

Affected products

• Authentikat-Jwt Project Authentikat-Jwt: through 0.4.5

References

• https://github.com/jasongoodwin/authentikat-jwt/commit/2d2fa0d40ac8f2f7aa7e9b070fa1a25eee082cb0
• https://github.com/jasongoodwin/authentikat-jwt/issues/12
• https://github.com/jasongoodwin/authentikat-jwt/pull/36
• https://github.com/jasongoodwin/authentikat-jwt/commit/2d2fa0d40ac8f2f7aa7e9b070fa1a25eee082cb0
• https://github.com/jasongoodwin/authentikat-jwt/issues/12
• https://github.com/jasongoodwin/authentikat-jwt/pull/36

Get alerted when CVE-2017-18239 or the next vulnerability affects your stack