CVE-2021-29455

Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT. This allows to forge a valid JWT. The problem has been patched in version 1.3.1 by deprecating the JWT refresh function, which was an overdue deprecation regardless (the "refresh" flow is no longer used).

• CWE-347

• https://github.com/grassrootza/grassroot-platform/Product, Third Party Advisory
• https://github.com/grassrootza/grassroot-platform/commit/a2e6e885f8183a066d938cf909fd813a7af7d67fPatch, Third Party Advisory
• https://github.com/grassrootza/grassroot-platform/security/advisories/GHSA-f65w-6xw8-6734Third Party Advisory
• https://github.com/grassrootza/grassroot-platform/Product, Third Party Advisory
• https://github.com/grassrootza/grassroot-platform/commit/a2e6e885f8183a066d938cf909fd813a7af7d67fPatch, Third Party Advisory
• https://github.com/grassrootza/grassroot-platform/security/advisories/GHSA-f65w-6xw8-6734Third Party Advisory

Published

Apr 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29449Pi-hole is a Linux network-level advertisement and Internet …7.8
• CVE-2021-29450Wordpress is an open source CMS. One of the blocks in the Wo…4.3
• CVE-2021-29451Portofino is an open source web development framework. Porto…9.1
• CVE-2021-29452a12n-server is an npm package which aims to provide a simple…6.5
• CVE-2021-29453matrix-media-repo is an open-source multi-domain media repos…6.5
• CVE-2021-29454Smarty is a template engine for PHP, facilitating the separa…8.8
• CVE-2021-29456Authelia is an open-source authentication and authorization …5.4
• CVE-2021-29457Exiv2 is a command-line utility and C++ library for reading,…7.8
• CVE-2021-29458Exiv2 is a command-line utility and C++ library for reading,…5.5
• CVE-2021-29459XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2021-29460Kirby is an open source CMS. An editor with write access to …5.4
• CVE-2021-29461Discord Recon Server is a bot that allows one to do one's re…8.8