Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-29266

apisix/jwt-auth may leak secrets in error response

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache APISIX

  • Apache APISIX to ≤ 2.13.0affected

References