CVE-2019-7644

CRITICAL

Auth0 Auth0-WCF-Service-JWT <1.0.4 - Info Disclosure

Title source: llm
STIX 2.1

Description

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://auth0.com/docs/security/bulletins/cve-2019-7644

Scores

CVSS v3 9.8
EPSS 0.0052
EPSS Percentile 67.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-209
Status published
Products (2)
auth0/auth0-wcf-service-jwt < 1.0.4
nuget/Auth0-WCF-Service-JWT 0 - 1.0.4NuGet
Published Apr 11, 2019
Tracked Since Feb 18, 2026