CVE-2018-0114

CVE-2018-0114 describes a critical vulnerability in the Cisco node-jose open source library (versions prior to 0.11.0) that allows unauthenticated, remote attackers to re-sign JSON Web Tokens (JWTs). This flaw stems from the library's adherence to the JSON Web Signature (JWS) standard, which permits embedding a public key within the JWS header for verification. An attacker can exploit this by replacing the original signature, inserting an attacker-controlled public key into the header, and then signing the token with their corresponding private key, effectively forging valid JWS objects. The vulnerability carries a high CVSS score of 7.5, indicating a severe impact with a network attack vector and low attack complexity, potentially leading to high integrity compromise without requiring user interaction. While not currently listed in CISA's KEV catalog, an exploit (EDB-44324) is publicly available on ExploitDB, confirming its exploitability. Despite the public exploit, there is minimal community discussion or media coverage surrounding this CVE.