CVE-2018-1000125

inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack appear to be exploitable via an attacker crafting a token with a valid header and body and then requests it to be validated. This vulnerability appears to have been fixed in 1.3.0 and later or after commit 0d94dcef0133d699f21d217e922564adbb83a227.

• CWE-20

• https://github.com/inversoft/prime-jwt/blob/master/CHANGESRelease Notes, Third Party Advisory
• https://github.com/inversoft/prime-jwt/issues/2Third Party Advisory
• https://github.com/inversoft/prime-jwt/blob/master/CHANGESRelease Notes, Third Party Advisory
• https://github.com/inversoft/prime-jwt/issues/2Third Party Advisory

Published

Mar 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000119Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and ear…
• CVE-2018-1000120A buffer overflow exists in curl 7.12.3 to and including cur…
• CVE-2018-1000121A NULL pointer dereference exists in curl 7.21.0 to and incl…
• CVE-2018-1000122A buffer over-read exists in curl 7.20.0 to and including cu…
• CVE-2018-1000123Ionic Team Cordova plugin iOS Keychain version before commit…
• CVE-2018-1000124I Librarian I-librarian version 4.8 and earlier contains a X…10
• CVE-2018-1000126Ajenti version 2 contains an Information Disclosure vulnerab…
• CVE-2018-1000127memcached version prior to 1.4.37 contains an Integer Overfl…
• CVE-2018-1000128Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000129An XSS vulnerability exists in the Jolokia agent version 1.3…
• CVE-2018-1000130A JNDI Injection vulnerability exists in Jolokia agent versi…
• CVE-2018-1000131Pradeep Makone wordpress Support Plus Responsive Ticket Syst…