Release v2.0.4 - Security Patch

Release Date: May 8, 2026

🔒 Security Update

Fixed

CRITICAL: JWT Signature Verification Vulnerability (GHSA-223g-f5mq-gw33)
- Fixed JWT signature verification that was disabled in authentication middleware
- Prevents JWT forgery attacks and unauthorized account takeover
- All JWT tokens now properly verified with server secret key

What Was Fixed

The application was disabling JWT signature verification with options={"verify_signature": False}, which allowed attackers to forge authentication tokens without the server checking the signature.

Files Updated:

backend/routes/dashboard.py - Enabled JWT signature verification
backend/main.py - Enabled JWT signature verification
backend/activity_logger.py - Enabled JWT signature verification

Changes:

# Before (Vulnerable)
decoded = jwt.decode(token, options={"verify_signature": False}, ...)

# After (Fixed)
decoded = jwt.decode(token, jwt_secret_key, algorithms=["HS256", "RS256"])

Security Impact

✅ Tokens without valid signatures are now properly rejected
✅ Attackers can no longer forge authentication tokens
✅ Account takeover vulnerability is closed
✅ Server validates token authenticity using cryptographic signature

📦 Installation

NPM

npm install @th30d4y/openlearnx@2.0.4

Yarn

yarn add @th30d4y/openlearnx@2.0.4

PNPM

pnpm add @th30d4y/openlearnx@2.0.4

📝 Changelog

Updated package version to 2.0.4
Created CHANGELOG.md with version history
Security patch for JWT vulnerability (GHSA-223g-f5mq-gw33)

🔗 References

Security Advisory: GHSA-223g-f5mq-gw33
CWE: CWE-287 (Improper Authentication), CWE-347 (Improper Verification of Cryptographic Signature)
Severity: Moderate (High impact, limited exposure in development configurations)

👥 Credits

Reporter: @krrazee
Remediation Developer: @0x5t4l1n

⚠️ Important Notes

This is a security release and should be deployed immediately
The JWT_SECRET_KEY environment variable must be set (already handled in app configuration)
Previous versions (2.0.3 and earlier) are affected and should be updated

🚀 Next Steps

Install the latest version: npm install @th30d4y/openlearnx@2.0.4
Deploy to your environment
Verify JWT authentication is working correctly
Monitor for any authentication-related issues

For more information, visit: https://github.com/th30d4y/OpenLearnX

2.5 KiB Raw Blame History