CVE-2016-10555

CVE-2016-10555 affects jwt-simple versions 0.3.0 and earlier, stemming from a lack of algorithm enforcement in the jwt.decode() function. This allows an attacker to specify the algorithm, potentially tricking the server into using an RSA public key as an HMAC private key, leading to arbitrary data forgery. Rated as MEDIUM severity (CVSS 6.5), it is network-exploitable with low attack complexity and high integrity impact. While it has a high EPSS score and FAUCET Risk Score, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.