8 matches found
CVE-2026-81829
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
CVE-2026-81829 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
CVE-2026-81829
CVE-2026-81829 is a same-origin SSRF vulnerability in SmallRye JWT 's AwsAlbKeyResolver , used by applications (e.g., Quarkus) to verify JWTs signed by AWS Application Load Balancers. The root cause is that the resolver constructs the key-fetch URL by directly concatenating the attacker-controlle...
EUVD-2026-81617
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
CVE-2026-81829 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
CVE-2026-81829
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
PT-2026-94341
Name of the Vulnerable Software and Affected Versions SmallRye JWT affected versions not specified Description A flaw exists in the AwsAlbKeyResolver of SmallRye JWT, used for verifying JSON Web Tokens signed by AWS Application Load Balancers. When the AWS ALB key provider is active, the resolver...
CVE-2026-81829: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...