Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-45795

Janssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null, and AuthzRequestService.processRequestObject() does not reject the unrecognized RSA-OAEP algorithm when forceSignedRequestObject=true. This issue is fixed in version 2.0.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jansson Project
Products
Jansson
CVE-2025-54876

Jans CLI stores plaintext passwords in the local cli_cmd.log file

The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local cli_cmd.log file. This is fixed in the nightly prerelease.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jansson Project
Products
Jansson
CVE-2016-4425

jansson: stack exhaustion parsing a JSON file

Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Jansson Project
Products
Jansson
CVE-2013-6401

jansson: hash table collisions CPU usage DoS

Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Jansson Project
Products
Jansson
CVE-2020-36325

jansson: out-of-bounds read in json_loads() due to a parsing error

An issue was discovered in Jansson through 2.13.1. Due to a parsing error in json_loads, there's an out-of-bounds read-access bug. NOTE: the vendor reports that this only occurs when a programmer fails to follow the API specification

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Jansson Project
Products
Jansson