CVE-2021-32631

Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.

• CWE-290
• CWE-290

• https://github.com/nimble-platform/common/commit/12197a755bd524559bf4e16475595a2c6fcd34dbPatch, Third Party Advisory
• https://github.com/nimble-platform/common/commit/3b96cb0293d3443b870351945f41d7d55cb34b53Patch, Third Party Advisory
• https://github.com/nimble-platform/common/commit/a59ad46733912a5580530e39cac0e6ebc83cc563Patch, Third Party Advisory
• https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv28Third Party Advisory
• https://github.com/nimble-platform/common/commit/12197a755bd524559bf4e16475595a2c6fcd34dbPatch, Third Party Advisory
• https://github.com/nimble-platform/common/commit/3b96cb0293d3443b870351945f41d7d55cb34b53Patch, Third Party Advisory
• https://github.com/nimble-platform/common/commit/a59ad46733912a5580530e39cac0e6ebc83cc563Patch, Third Party Advisory
• https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv28Third Party Advisory

Published

Jul 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32625Redis is an open source (BSD licensed), in-memory data struc…8.8
• CVE-2021-32626Redis is an open source, in-memory database that persists on…8.8
• CVE-2021-32627Redis is an open source, in-memory database that persists on…7.5
• CVE-2021-32628Redis is an open source, in-memory database that persists on…7.5
• CVE-2021-32629Cranelift is an open-source code generator maintained by Byt…8.8
• CVE-2021-32630Admidio is a free, open source user management system for we…8.8
• CVE-2021-32632Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 a…4.3
• CVE-2021-32633Zope is an open-source web application server. In Zope versi…8.8
• CVE-2021-32634Emissary is a distributed, peer-to-peer, data-driven workflo…7.2
• CVE-2021-32635Singularity is an open source container platform. In verions…6.3
• CVE-2021-32637Authelia is a a single sign-on multi-factor portal for web a…10
• CVE-2021-32638Github's CodeQL action is provided to run CodeQL-based code …4.4