-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/robbert229/jwt | go | < 0.0.0-20170426191122-ca1404ee6e83 | 0.0.0-20170426191122-ca1404ee6e83 |
Miggo AIRoot Cause AnalysisThe commit diff shows a critical change from strings.Compare to hmac.Equal in algorithms.go's validateSignature method. strings.Compare performs a non-constant-time string comparison that leaks timing information about HMAC matching through early exit on mismatch. This matches the described vulnerability pattern of timing side-channels in HMAC validation. The direct replacement with a constant-time comparison function (hmac.Equal) in the patch confirms this was the vulnerable code path.
Ongoing coverage of React2Shell