Vulnerability Details CVE-2023-51774
The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 13.7%
CVSS Severity
CVSS v3 Score 8.4
References
Products affected by CVE-2023-51774
-
cpe:2.3:a:json-jwt_project:json-jwt:1.16.3