Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.

Affected: npm: angular-jwt

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the `jwtInterceptorProvider.whiteListedDomains` setting to bypass the domain allowlist filter via a crafted domain.

For example, if the setting is initialized with:

`jwtInterceptorProvider.whiteListedDomains = ['whitelisted.Example.com'];`

An attacker can set up a domain `whitelistedXexample.com` that will pass the allow list filter, as it considers the `.` separator to be a regex whildcard which matches any character.