CVE-2021-27884
CVE-2021-27884
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
CVSS 5.1 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
yapi-vendor npm
- Affected ranges
- SEMVER: < 1.9.3
Update to 1.9.3