HCL DevOps Loop Improper Authentication Vulnerability Allowing Token Misuse

A vulnerability exists in HCL DevOps Loop version 1.0.2 due to improper authentication in the API authentication middleware. This flaw allows authentication tokens to be accepted without adequate validation of their expiration and cryptographic signature. Consequently, an attacker could exploit this issue by using expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive resources and the ability to perform actions with elevated privileges.

Remediation

Users are advised to upgrade to HCL DevOps Loop version 1.0.3.