Authentication Bypass in D-Link D-View 8

A researcher at Tenable discovered an authentication bypass vulnerability in D-Link D-View 8 v2.0.1.28.

D-View 8 uses a static key (D-Link) to protect the JWT token used in user authentication:

// webApi-0.0.1-SNAPSHOT.jar!com.dlink.dview8.webapi.utils.TokenUtils

  public static String verifyToken(String token) {
    if (Utils.isEmpty(token))
      return null; 
    Algorithm algorithm = Algorithm.HMAC256("D-Link");
    JWTVerifier verifier = JWT.require(algorithm).build();
    DecodedJWT jwt = verifier.verify(token);
    return jwt.getClaim("userId").asString();
  }

D-View 8 supports login with an API key, but the supplied API key in the JWT token …