CVE-2024-31033
MEDIUM
Published Apr 1, 2024
Modified Apr 15, 2026
Description
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
Is your site exposed to CVE-2024-31033?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
6.8
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
Other References
https://github.com/2308652512/JJWT_BUG
https://github.com/jwtk/jjwt
https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358
https://www.viralpatel.net/java-create-validate-jwt-token/
https://github.com/2308652512/JJWT_BUG
https://github.com/jwtk/jjwt
https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358
https://www.viralpatel.net/java-create-validate-jwt-token/
Frequently Asked Questions
What is CVE-2024-31033? +
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date. It has a CVSS v3.1 base score of 6.8 (MEDIUM).
How severe is CVE-2024-31033? +
CVE-2024-31033 has a CVSS v3.1 score of 6.8 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
How do I check if I'm vulnerable to CVE-2024-31033? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.