JWT signature validation can be bypassed in versions <= 1.3.0

[rcadob]

Summary

The prime-jwt implementation allows that any not-signed JWT be decoded and, therefore, validated by JWTDecoder class, even when a Verifier object is provided. This issue affects versions <= 1.3.0.

For security reasons, I'm contacting the developers by email with the necessary technical details.

Description

When the JWT.getDecoder().decode(String, Verifier...) is called, the JWT signature will be ignored due to a lack of validation in JWTDecoder. A new condition should be added in this class to prevent that any encodedJWT without the signature part be decoded if exists at least 1 verifier object.

[robotdan]

Hi @rcadob thank you for reporting this issue. The issue has been patched.

[robotdan]

Fixed under abb0d47