Notification RelayPlatform1 hop
- ApplicationNotification Relay
Drawing the sheet
USY-2026-0106 · Improper authentication · score 9.8
When a public key is supplied as a verification secret without pinning the algorithm, an HMAC-signed token is validated against that public key as if it were a shared secret. Any party holding the public key can mint an accepted token.
SyntheticThis advisory is invented for the demonstration. jsonwebtoken is a real package; nothing described here has been reported against it.
Every exposed application reaches this on a route of its own: no intermediate package is shared by more than one path. There is no single change here; each application has to move separately, or the ecosystem has to move first.
Declared directlyNotification Relay, Storefront Web. Nothing sits in between; the dependency is in the manifest.
Auth Gateway
Checkout Service