CVE-2026-25537
📋 TL;DR
This vulnerability in the jsonwebtoken Rust library allows attackers to bypass time-based security restrictions like 'Not Before' (nbf) and 'Expiration' (exp) checks by providing malformed claim types. Attackers can potentially bypass authentication and authorization controls in applications using this library. All applications using jsonwebtoken versions before 10.3.0 are affected.
💻 Affected Systems
- jsonwebtoken Rust library
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to protected resources and administrative functions.
Likely Case
Bypass of time-based restrictions allowing expired or premature tokens to be accepted as valid.
If Mitigated
Limited impact if applications use required_spec_claims to enforce claim validation.
🎯 Exploit Status
Exploitation requires crafting JWT tokens with string values for numeric claims like nbf or exp.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.3.0
Vendor Advisory: https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc
Restart Required: Yes
Instructions:
1. Update Cargo.toml to require jsonwebtoken >=10.3.0
2. Run 'cargo update jsonwebtoken'
3. Rebuild and redeploy your application
🔧 Temporary Workarounds
Enforce required claims
allMark nbf and exp claims as required in required_spec_claims configuration
// In your JWT validation code, ensure required_spec_claims includes "nbf" and "exp"
🧯 If You Can't Patch
- Implement additional validation layer to check claim types before passing to jsonwebtoken
- Use web application firewall rules to detect and block malformed JWT tokens
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or Cargo.toml for jsonwebtoken version <10.3.0Check Version:
grep jsonwebtoken Cargo.lock | grep versionVerify Fix Applied:
Verify jsonwebtoken version is >=10.3.0 in Cargo.lock after update📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with unusual JWT claim types
- Successful authentications with expired or future-dated tokens
Network Indicators:
- HTTP requests with JWT tokens containing string values for numeric claims
SIEM Query:
source="application_logs" AND ("FailedToParse" OR "malformed claim" OR "invalid claim type")