CVE-2026-21003-JWT-none-Algorithm-Bypass-via-kid-Header-Omission

CVE-2026-21003 – JWT "none" Algorithm Bypass via kid Header Omission Program Code Node.js // jwtverifyserver.js - Vulnerable JWT verification const jwt = require'jsonwebtoken'; const express = require'express'; const app = express; app.useexpress.json; const publicKey = -----BEGIN PUBLIC KEY-----...

smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

EUVD-2026-81617

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829

CVE-2026-81829 is a same-origin SSRF vulnerability in SmallRye JWT 's AwsAlbKeyResolver , used by applications (e.g., Quarkus) to verify JWTs signed by AWS Application Load Balancers. The root cause is that the resolver constructs the key-fetch URL by directly concatenating the attacker-controlle...

CVE-2026-81829 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

PT-2026-94341

Name of the Vulnerable Software and Affected Versions SmallRye JWT affected versions not specified Description A flaw exists in the AwsAlbKeyResolver of SmallRye JWT, used for verifying JSON Web Tokens signed by AWS Application Load Balancers. When the AWS ALB key provider is active, the resolver...

CVE-2026-18675

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process,...

CVE-2026-18675: Uncaught Exception

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process,...

AZL-93027 CVE-2026-48524 affecting package python-jwt for versions less than 2.13.0-1

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.getsigningkey forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited...

jwt-attack-suite

JWT Attack Suite Offensive JWT testing toolkit for penetrat...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchKey function. An attacker can cause the server to make arbitrary HTTP requests to attacker-controlled destinations by crafting a JWT with malicious claim values that are interpolated into th...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchKey function. An attacker can cause the server to make arbitrary HTTP requests to attacker-controlled destinations by crafting a JWT with malicious claim values that are interpolated into th...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchKey function. An attacker can cause the server to make arbitrary HTTP requests to attacker-controlled destinations by crafting a JWT with malicious claim values that are interpolated into th...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchKey function. An attacker can cause the server to make arbitrary HTTP requests to attacker-controlled destinations by crafting a JWT with malicious claim values that are interpolated into th...

Firebase PHP-JWT key/algorithm type confusion

In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue e.g., RS256 / HS256 exists via the kid aka Key ID header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way t...

GHSA-8XF4-W7QW-PJJW Firebase PHP-JWT key/algorithm type confusion

In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue e.g., RS256 / HS256 exists via the kid aka Key ID header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way t...