CVE-2024-51744
LowSummary
Unclear documentation of error behavior in `ParseWithClaims` in golang-jwt can lead to users not checking errors properly. Especially, if a token is both expired and invalid, the returned errors may be misleading.
Risk Assessment
The risk is that applications may fail to detect invalid tokens, potentially leading to unauthorized access or other security issues.
Recommendation
Review the documentation carefully and always check all returned errors; consider updating to a version with improved documentation.
Original NVD description (English source)
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWit