Auth0 angular-jwt misinterprets allowlist as regex
Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain allowlist filter via a crafted domain.
For example, if the setting is initialized with:
jwtInterceptorProvider.whiteListedDomains = ['whitelisted.Example.com'];
An attacker can set up a domain whitelistedXexample.com that will pass the allow list filter, as it considers the . separator to be a regex whildcard which matches any character.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | angular-jwt | < 0.1.10 | 0.1.10 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-11537
- https://github.com/auth0/angular-jwt/pull/174
- https://github.com/auth0/angular-jwt/commit/a4f03b49c3fb47cc6375c2a33b5ac11ca3c606f0
- https://github.com/auth0/angular-jwt/commit/e368cf124443507f1710f60ae855c4c54eebc6ea
- https://auth0.com/docs/security/bulletins/cve-2018-11537
- https://github.com/auth0/angular-jwt
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-20- Platform
- npm
- Package
angular-jwt- Disclosed
- 14.05.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vm2p-f5j4-mj6g - CC BY 4.0
Vulnerability history: angular-jwt
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.