GMS-2020-255: Authentication Bypass in express-laravel-passport

September 4, 2020 (updated October 4, 2021)

All versions of express-laravel-passport are vulnerable to an Authentication Bypass. The package fails to properly validate JWTs, allowing attackers to send HTTP requests impersonating other users. Upgrade to or later.

References

github.com/advisories/GHSA-v66p-w7qx-wv98
hackerone.com/reports/748214
www.npmjs.com/advisories/1450

Code Behaviors & Features

Detect and mitigate GMS-2020-255 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →