CVE-2023-31580

CVE-2023-31580 is a medium-severity vulnerability affecting networknt light-oauth2 versions prior to 2.1.27, where the application fails to verify the authenticity of public keys used for JWT token validation. This critical oversight allows unauthenticated attackers to forge JWT tokens, potentially gaining unauthorized access to the application. While the attack complexity is high, successful exploitation could lead to full compromise of confidentiality. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.