-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| node-jose | npm | < 0.11.0 | 0.11.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from automatic trust in JWS header-embedded JWK keys during verification. The changelog for 0.11.0 explicitly shows the addition of an 'allowEmbeddedKeys' option to control this behavior, indicating the verification function previously lacked this safeguard. The POC demonstrates header manipulation that would be processed by the verification flow, and CWE-347 confirms it's a signature validation issue. The verification function is the logical point where header JWK processing and signature checking intersect.