CVE-2026-107723

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

Insufficient Session Expiration

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Insufficient Session Expiration via the verifier cache in src/verifier.js, where the cacheSet function only derived exp and nbf bounds from a token's payload when the iat claim was also...

NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.4...

GHSA-5HJW-83FP-PHQ9 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Summary fast-jwt's createVerifier silently skips all configured claim validators exp, nbf, iss, aud, sub, jti, nonce when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced only the signature. This breaks the library's...

Improper Validation of Specified Type of Input

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the decode function in src/decoder.js, where a JWT with a JSON array as its payload passes the object type check because typeof ===...

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Summary fast-jwt's createVerifier silently skips all configured claim validators exp, nbf, iss, aud, sub, jti, nonce when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced only the signature. This breaks the library's...

CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107723

The fast-jwt library (versions prior to 6.3.0 ) is vulnerable to a silent claim-validator bypass when a JWT payload is a JSON array . The root cause is located in src/decoder.js, where the system verifies that the payload is an object but fails to reject arrays. Because the claim validator loop l...

EUVD-2026-95348

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...

CVE-2026-107275

The @fastify/jwt plugin for the Fastify web framework (versions before 10.2.3 ) contains a flaw where the parser silently drops unreadable time spans passed to expiresIn , notBefore , or maxAge . Unreadable formats include compound spans, month units, ISO 8601 durations, decimal commas, or values...

EUVD-2026-94851

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...

Authentication Token Injection

payload is vulnerable to Authentication Token Injection. The vulnerability is due to a custom field option that maps a field to a reserved authentication claim name, where unintended values can be placed in the authentication token issued at login and attackers can exploit this by configuring suc...

Improper Verification of Cryptographic Signature

Overview @backstage/plugin-auth-backend-module-cloudflare-access-provider is a The cloudflare-access-provider backend module for the auth plugin. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the jwtVerify call in helpers.ts, which verifi...

MARS: Malware Analysis with Rule-Based Scoring of LLM Claims

Large language models can triage malware through direct verdicts or behavioral claims scored by an external policy. We present MARS, a malware triage framework, and compare direct classification with single-pass claim scoring using the same evidence collector and identical static evidence bundles...

dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...

CVE-2026-105863

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version...

CVE-2026-98219

In the Linux kernel, the following vulnerability has been resolved: schedext: Close the pre-enable ops error claim window scxallocandaddsched publishes ops-priv before scxrootenableworkfn switches the state to SCXENABLING. An error claimed via scxbpferrorbstr from an associated BPF program in tha...