{"id":"CVE-2016-8218","details":"An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an \"Unauthenticated JWT signing algorithm in routing\" issue.","modified":"2026-08-27T08:18:27.759128Z","published":"2017-06-13T06:29:00.237Z","references":[{"type":"FIX","url":"https://www.cloudfoundry.org/cve-2016-8218/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry-attic/cf-release","events":[{"introduced":"0"},{"last_affected":"7f7d1158e8f1cdc99d8c6292951d5dcb0e3ddbae"},{"introduced":"15ead65649b3a1e8e1b8db7930c81d3c5875b582"},{"last_affected":"9e31b98e104825c136d96a711bec2135f4a6ed33"}],"database_specific":{"cpe":["cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:204:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:205:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:206:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:207:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:208:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:209:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:210:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:211:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:212:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:213:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:214:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:215:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:217:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:218:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:219:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:220:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:221:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:222:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:223:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:224:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:225:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:226:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:227:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:228:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:229:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:230:*:*:*:*:*:*:*","cpe:2.3:a:cloudfoundry:cf-release:231:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"203"},{"introduced":"204"},{"last_affected":"204"},{"introduced":"205"},{"last_affected":"205"},{"introduced":"206"},{"last_affected":"206"},{"introduced":"207"},{"last_affected":"207"},{"introduced":"208"},{"last_affected":"208"},{"introduced":"209"},{"last_affected":"209"},{"introduced":"210"},{"last_affected":"210"},{"introduced":"211"},{"last_affected":"211"},{"introduced":"212"},{"last_affected":"212"},{"introduced":"213"},{"last_affected":"213"},{"introduced":"214"},{"last_affected":"214"},{"introduced":"215"},{"last_affected":"215"},{"introduced":"217"},{"last_affected":"217"},{"introduced":"218"},{"last_affected":"218"},{"introduced":"219"},{"last_affected":"219"},{"introduced":"220"},{"last_affected":"220"},{"introduced":"221"},{"last_affected":"221"},{"introduced":"222"},{"last_affected":"222"},{"introduced":"223"},{"last_affected":"223"},{"introduced":"224"},{"last_affected":"224"},{"introduced":"225"},{"last_affected":"225"},{"introduced":"226"},{"last_affected":"226"},{"introduced":"227"},{"last_affected":"227"},{"introduced":"228"},{"last_affected":"228"},{"introduced":"229"},{"last_affected":"229"},{"introduced":"230"},{"last_affected":"230"},{"introduced":"231"},{"last_affected":"231"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["204","205","206","207","208","209","210","211","212","213","214","215","217","218","219","220","221","222","223","224","225","226","227","228","229","230","231","v231","v205","v203","v183","v170","v161","v157","v156","rc145.0","v143","works-for-us","v140","v137","v136","v135","v134","v133","v132","scotty_09012012","v119","v109","v105","v104","v103","v102","v100","v99","-","log","list"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-8218.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/routing-release","events":[{"introduced":"0"},{"last_affected":"fc9d5f2e01145ceabc137490871f9951185ce749"}],"database_specific":{"cpe":"cpe:2.3:a:cloudfoundry:routing-release:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"0.141.0"}],"source":"CPE_RANGE"}}],"versions":["0.141.0","0.137.0","0.136.0","0.134.0","0.123.0","0.121.0","0.118.0","0.99.0","0.69.0","0.66.0","0.62.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-8218.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}