{"action":"Upgrade json-jwt to 1.15.3.1 or later.","affected":[{"fixed":"1.16.6","introduced":"1.16.0"},{"fixed":"1.15.3.1","introduced":"0"}],"component":"json-jwt","cve_ids":["CVE-2023-51774"],"ecosystem":"RubyGems","epss":0.00231,"exploited":false,"fixed_versions":["1.16.6","1.15.3.1"],"ghsa_id":"GHSA-c8v6-786g-vjx6","id":"tcs_01M5KEJNTPZVGNHJNF3HXY0WH2","modified_at":"2026-09-10T03:50:06.209342609Z","published_at":"2024-02-29T03:33:14Z","references":["https://osv.dev/vulnerability/GHSA-c8v6-786g-vjx6","https://nvd.nist.gov/vuln/detail/CVE-2023-51774","https://github.com/nov/json-jwt/issues/120","https://github.com/nov/json-jwt/issues/121","https://github.com/nov/json-jwt/commit/593ea8bcaf2629048bad8c036191f2da0a2e713c","https://github.com/nov/json-jwt/commit/9c4d842a9465bd7960570ca326c3de79b4abc9d0","https://github.com/P3ngu1nW/CVE_Request/blob/main/novjson-jwt.md","https://github.com/nov/json-jwt","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json-jwt/CVE-2023-51774.yml"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-c8v6-786g-vjx6","url":"https://osv.dev/vulnerability/GHSA-c8v6-786g-vjx6"}],"summary":"json-jwt allows bypass of identity checks via a sign/encryption confusion attack"}