Medium, CVSS 5.5crates.ioPublished
jsonwebtoken has Type Confusion that leads to potential authorization bypass
CVE-2026-25537 · GHSA-h395-gr6q-cpjc
- Affected
- crates.io jsonwebtoken < 10.3.0
- Fixed in
- 10.3.0· Vendor fix available
- Issue
- It has been discovered that there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks the claim as “FailedToParse”. Crucially, the validation logic treats this “FailedToParse” state identically to “NotPresent”. This means that if a check is enabled (like: validatenbf = true), but the claim is not explicitly marked as required in requiredspecclaims, the library will skip the validation check entirely for the malformed claim, treating it as if it were not there. This allows attackers to bypass critical time-based security restrictions (like “Not Before” checks) and commit potential authentication and authorization bypasses. Details: The vulnerability stems from the interaction between the TryParse enum and the validate function in src/validation.rs. 1. The TryParse…
Recommended action: Upgrade to 10.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.