Missing validation of JWT signature in `ManyDesigns/Portofino`

GHSA-6g3c-2mh5-7q6x · CVE-2021-29451

Published Apr 19, 2021 · Modified Jul 8, 2026

Description

Impact

Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens.
This allows forging a valid JWT.

Patches

The issue will be patched in the upcoming 5.2.1 release.

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/ManyDesigns/Portofino

References

WEB https://github.com/ManyDesigns/Portofino/security/advisories/GHSA-6g3c-2mh5-7q6x
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-29451
WEB https://github.com/ManyDesigns/Portofino/commit/8c754a0ad234555e813dcbf9e57d637f9f23d8fb
WEB https://mvnrepository.com/artifact/com.manydesigns/portofino

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes