Medium severity5.9NVD Advisory· Published Oct 25, 2023· Updated Jun 17, 2026
CVE-2023-31580
CVE-2023-31580
Description
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.networknt:light-oauth2Maven | < 2.1.27 | 2.1.27 |
Affected products
3- light-oauth2/light-oauth2description
Patches
Vulnerability mechanics
References
4- github.com/KANIXB/JWTIssues/blob/main/Certification%20Verification%20issue%20in%20light-oauth2.mdnvdExploitWEB
- github.com/advisories/GHSA-mx47-h5fv-ghwhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-31580ghsaADVISORY
- github.com/networknt/light-oauth2/issues/369nvdIssue TrackingWEB
News mentions
0No linked articles in our index yet.