CVE-2015-10004

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
github.com/robbert229/jwt	github.com/robbert229/jwt	< 0.0.0-20170426191122-ca1404ee6e83

References

https://github.com/robbert229/jwt/commit/ca1404ee6e83fcbafb66b09ed0d543850a15b654Patch, Third Party Advisory
https://github.com/robbert229/jwt/issues/12Issue Tracking, Third Party Advisory
https://pkg.go.dev/vuln/GO-2020-0023Patch, Vendor Advisory
https://github.com/robbert229/jwt/commit/ca1404ee6e83fcbafb66b09ed0d543850a15b654Patch, Third Party Advisory
https://github.com/robbert229/jwt/issues/12Issue Tracking, Third Party Advisory
https://pkg.go.dev/vuln/GO-2020-0023Patch, Vendor Advisory

Timeline

Published: Dec 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-100057.5A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/c CVE-2015-100066.1A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq. Affected by this issue is some unknown functiona CVE-2015-100076.1** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM and classified as problematic. Affected by this issue is some u CVE-2015-100089.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM. It has been classified as critical. This affects an unknown pa CVE-2015-100099.8A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file a CVE-2015-100110.0Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary c CVE-2015-100106.1A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file r CVE-2015-100119.8A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoi CVE-2015-100127.5** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. A CVE-2015-100136.1A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affecte CVE-2015-100149.8A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipula CVE-2015-100159.8A vulnerability, which was classified as critical, has been found in glidernet ogn-live. This issue affects some unknown processing. The man