title: Timing side-channel in github.com/robbert229/jwt
description: Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
problem types: CWE 208: Information Exposure Through Timing Discrepancy
affected:
{
vendor: github.com/robbert229/jwt
product: github.com/robbert229/jwt
collectionURL: https://pkg.go.dev
packageName: github.com/robbert229/jwt
versions:
version: 0, lessThan: 0.0.0-20170426191122-ca1404ee6e83, status: affected, versionType: semver
programRoutines:
name: Algorithm.validateSignature
name: Algorithm.Validate
defaultStatus: unaffected
}