GHSA-h6mp-mc7g-mg49

Suggest an improvement
Source
https://github.com/advisories/GHSA-h6mp-mc7g-mg49
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-h6mp-mc7g-mg49/GHSA-h6mp-mc7g-mg49.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h6mp-mc7g-mg49
Published
2024-05-21T18:16:24Z
Modified
2024-05-21T18:31:24.211467Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token
Details

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication.

References

Affected packages

Packagist / scheb/two-factor-bundle

Package

Name
scheb/two-factor-bundle
Purl
pkg:composer/scheb/two-factor-bundle

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.7.0

Affected versions

v3.*

v3.0.0
v3.1.0
v3.2.0
v3.3.0
v3.3.1
v3.4.0
v3.5.0
v3.5.1
v3.6.0
v3.6.1
v3.6.2
v3.6.3