CVE-2024-25189

Summary

CVE-2024-25189 is a newly disclosed vulnerability affecting version 1.15.3 of the libjwt library. This issue arises from the library's use of the non-constant time strcmp function for authentication verification. An adversary can exploit this timing side channel vulnerability to bypass authentication and gain unauthorized access to protected resources. The impact of this vulnerability is significant as libjwt is widely used for JSON Web Token (JWT) processing in various applications. To mitigate this risk, it's recommended to upgrade to the latest version of the library that uses constant-time comparison functions instead.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.