CVE-2021-44878

Katalog CVE

CVSS 7.5 · High EPSS 0,90%

Kerentanan Improper Verification of Cryptographic Signature pada pac4j. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using "none" as the value of "alg" key in the header with an empty signature value.

Rincian

Terbit di NVD

6 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html mitigasi · advisory vendor
• https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae patch · advisory pihak ketiga
• https://openid.net/specs/openid-connect-core-1_0.html#IDToken product · advisory pihak ketiga