CVE-2026-78426: Incorrect Authorization

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token...

PT-2026-94202

Name of the Vulnerable Software and Affected Versions NeuVector affected versions not specified Description The JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. This allows an attacker who possesses a valid, non-expired JWT to bypass the logout mechanism by...

SUSE CVE-2026-78426

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token...