An issue was discovered in Object First The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function that doesn’t produce cryptographically strong sequences. An attacker can predict these sequences and generate a JWT token. As a result, an attacker can get access to the Web UI. This is fixed in More

Back to Main

Subscribe for the latest news:
Generated by Feedzy
%d bloggers like this: