MICROSENS NMP Web+ Authentication Bypass Vulnerability via Forged JSON Web Tokens

An authentication bypass vulnerability has been identified in MICROSENS NMP Web+ versions through 3.2.5. This vulnerability allows an unauthenticated attacker to generate forged JSON Web Tokens (JWT), bypassing authentication mechanisms. The issue arises from the use of hard-coded security-relevant constants, leading to insufficient session expiration, as the JWTs do not expire, potentially allowing unauthorized access to the system.

Impact

Exploitation of this vulnerability could lead to unauthorized access by allowing attackers to bypass authentication and gain system access.

Remediation

Users are advised to update to MICROSENS NMP Web+ Version 3.3.0 for Windows or Linux. Instructions for downloading this version are available on the MICROSENS website.