CVE-2023-33371

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Aug 3, 2023
Updated: Aug 5, 2023
CWE ID 798

Summary

CVE-2023-33371 is a vulnerability affecting IDSecure version 4.7.26.0 and earlier. The issue lies in the use of a hardcoded cryptographic key for signing and verifying JSON Web Token (JWT) session tokens. Attackers can exploit this vulnerability by signing arbitrary session tokens, enabling them to bypass authentication processes and gain unauthorized access to protected systems or data. The use of a hardcoded key significantly increases the risk of token manipulation and security breaches. It is strongly recommended that affected organizations update to the latest version of IDSecure or implement alternative token signing methods to mitigate this threat.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share