What is CVE-2019-7644?

CVE-2019-7644 is a critical-severity vulnerability in Auth0 Auth0-wcf-service-jwt, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 9.8/10. Published 2019-04-11.

How severe is CVE-2019-7644?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2019-7644 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Auth0 Auth0-wcf-service-jwt

CVE-2019-7644

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token…

EPSS: 0.017 (73.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Auth0 Auth0-wcf-service-jwt
N/a — versions n/a

Weakness classification (CWE)

CWE-209 — Generation of Error Message Containing Sensitive Information

Public proof-of-concept exploits

References

cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-7644?: CVE-2019-7644 is a critical-severity vulnerability in Auth0 Auth0-wcf-service-jwt, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 9.8/10. Published 2019-04-11.
How severe is CVE-2019-7644?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2019-7644 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.