-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability documentation explicitly references the Oauth2KeysGetHandler class and its failure to verify certificates when obtaining public keys. The linked GitHub issue #369 and security advisory both identify this handler as the source of improper certificate validation (CWE-295) and signature verification (CWE-347). The handleRequest() method is the entry point for key retrieval operations, making it the logical location for the missing validation checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.networknt:light-oauth2 | maven | < 2.1.27 | 2.1.27 |