search

FusionAuth / fusionauth-issues

FusionAuth issue submission project
https://fusionauth.io
90 stars 12 forks source link

A JWT configured to be signed using the `ES512` algorithm may have an invalid signature #2661

Closed robotdan closed 4 months ago

robotdan commented 4 months ago

A JWT configured to be signed using the ES512 algorithm may have an invalid signature

Description

It is possible that when using the ES512 algorithm to sign a JWT, the signature may not be valid.

Observed versions

1.48.0

Affects versions

>= 1.4.0. We introduced Elliptic Curve support in version 1.4.0.

Steps to reproduce

  1. Sign a JWT using ES512
  2. Verify the signature

In testing, one out of every 1-2k signatures may be invalid.

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Additional context

Add any other context about the problem here.

robotdan commented 4 months ago

Internal:

robotdan commented 4 months ago

Need to update to fusionauth-jwt version 5.3.2 from 5.2.4 to pick up this fix.