CVE-2017-18239

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.

• https://github.com/jasongoodwin/authentikat-jwt/commit/2d2fa0d40ac8f2f7aa7e9b070fa1a25eee082cb0Patch, Third Party Advisory
• https://github.com/jasongoodwin/authentikat-jwt/issues/12Issue Tracking, Third Party Advisory
• https://github.com/jasongoodwin/authentikat-jwt/pull/36Issue Tracking, Third Party Advisory
• https://github.com/jasongoodwin/authentikat-jwt/commit/2d2fa0d40ac8f2f7aa7e9b070fa1a25eee082cb0Patch, Third Party Advisory
• https://github.com/jasongoodwin/authentikat-jwt/issues/12Issue Tracking, Third Party Advisory
• https://github.com/jasongoodwin/authentikat-jwt/pull/36Issue Tracking, Third Party Advisory

Published

Mar 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18233An issue was discovered in Exempi before 2.4.4. Integer over…
• CVE-2017-18234An issue was discovered in Exempi before 2.4.3. It allows re…
• CVE-2017-18235An issue was discovered in Exempi before 2.4.3. The VPXChunk…
• CVE-2017-18236An issue was discovered in Exempi before 2.4.4. The ASF_Supp…
• CVE-2017-18237An issue was discovered in Exempi before 2.4.3. The PostScri…
• CVE-2017-18238An issue was discovered in Exempi before 2.4.4. The TradQT_M…
• CVE-2017-1824Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18240The Gentoo app-admin/collectd package before 5.7.2-r1 sets t…
• CVE-2017-18241fs/f2fs/segment.c in the Linux kernel before 4.13 allows loc…
• CVE-2017-18242The apply_dependent_coupling function in libavcodec/aacdec.c…
• CVE-2017-18243The unpack_parse_unit function in libavcodec/dirac_parser.c …
• CVE-2017-18244The stereo_processing function in libavcodec/aacps.c in Liba…