CERT24GHSA-r8gm-v65f-c973 — acryl-datahub missing JWT signature checkLoading data…
CERT24Threat Observatory
Period

GHSA-r8gm-v65f-c973 — acryl-datahub missing JWT signature check

The StatelessTokenService of the DataHub metadata service (GMS) does not verify the cryptographic signature of JWT tokens. If Metadata Service authentication is enabled, an attacker may connect to DataHub instances as any user. The issue may lead to an authentication bypass.

← Back to intelligence

GHSA-r8gm-v65f-c973 — acryl-datahub missing JWT signature check

The StatelessTokenService of the DataHub metadata service (GMS) does not verify the cryptographic signature of JWT tokens. If Metadata Service authentication is enabled, an attacker may connect to DataHub instances as any user. The issue may lead to an authentication bypass.