CVE-2022-29266CWE-209

apisix/jwt-auth may leak secrets in error response

published April 20, 2022

CVSS
—
EPSS
8%
Percentile
94.8
In the wild
Unconfirmed
What it is

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08140 · 94.8th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2022-04-20T07:15Z
EPSS history
Timeline
  • 20 APR 07:15Z
    apisix/jwt-auth may leak secrets in error response
    cvelistv5