Type confusion in JWT lib in rust - CVE-2026-25537

Vulnerability identifier: #VU122823

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-25537

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to a type confusion error when parsing standard claims in an incorrect format. If a claim is provided with an incorrect JSON type, the application's internal parsing mechanism marks the claim as "FailedToParse" and the validation logic treats this state identically to "NotPresent". If this check is enabled, e.g. "validate_nbf = true" but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim. A remote attacker can bypass authorization checks and gain unauthorized access to the application. 

JWT lib in rust
Fedora
rust-scx_rustland
rust-scx_layered
rust-ambient-id
rust-ybaas
rust-time-core
rust-weezl
rust-pore
rust-num-conv
rust-sequoia-keystore-server
rust-eif_build
rust-ingredients
rust-pretty-git-prompt
rust-crypto-auditing-log-parser
rust-crypto-auditing-client
rust-crypto-auditing-event-broker
rust-crypto-auditing-agent
keylime-agent-rust
rust-time-macros
rust-busd
rust-oo7-cli
rust-time
rust-muvm
rust-monitord-exporter
rust-prometheus-client-derive-encode
sad
rust-sigul-pesign-bridge
rust-app-store-connect
rust-btrd
rust-scx_rusty
rust-pleaser
rust-add-determinism
rust-scx_utils
rust-sevctl
tbtools
rust-wiremix
rust-shadow-rs
rust-below
tuigreet
rust-snpguest
uv
rust-rustyline-derive0.10
greetd
rust-cargo-c
rust-sccache
bustle
rust-monitord
rust-sequoia-chameleon-gnupg
rust-gst-plugin-reqwest
rust-gst-plugin-dav1d
rust-routinator
rust-procs
rust-git-delta
rust-cargo-deny
rust-prometheus-client
rust-git2
rust-bat
rust-coreos-installer
rust-gitui
rust-rbspy
rust-redlib
rust-nu
rust-speakersafetyd
rust-dtoa
rust-lsd
glycin
rust-sequoia-sq
ntpd-rs
rust-tealdeer
rust-heatseeker
maturin
rust-bytes
rust-sequoia-octopus-librnp
rust-rbw
rustup
rust-resctl-demo
rust-rd-hashd
rust-resctl-bench
rust-rd-agent
rust-git-interactive-rebase-tool
rust-onefetch
rust-dua-cli
asciinema
mirrorlist-server
envision
rust-pom
rust-afterburn
rust-jsonwebtoken
rust-rustyline14
rust-tokei
atuin
helix

Install updates from vendor's website.

JWT lib in rust - update to 10.3.0
rust-scx_rustland - addressed in versions 0.0.3-7.el9, 0.0.3-7.fc42, 0.0.3-7.fc43, 0.0.3-7.fc44, 0.0.3-7.fc45
rust-scx_layered - addressed in versions 0.0.6-7.el9, 0.0.6-7.fc42, 0.0.6-7.fc43, 0.0.6-7.fc44, 0.0.6-7.fc45
rust-ambient-id - addressed in versions 0.0.8-1.el10_2, 0.0.8-1.fc42, 0.0.8-1.fc43
rust-ybaas - addressed in versions 0.0.19-6.fc42, 0.0.19-6.fc43, 0.0.19-6.fc44, 0.0.19-6.fc45
rust-time-core - addressed in versions 0.1.8-1.el9, 0.1.8-1.el10_2, 0.1.8-1.fc42, 0.1.8-1.fc43, 0.1.8-1.fc44, 0.1.8-1.fc45
rust-weezl - addressed in versions 0.1.12-3.el9, 0.1.12-3.el10_2, 0.1.12-3.fc42, 0.1.12-3.fc43, 0.1.12-3.fc44, 0.1.12-3.fc45
rust-pore - addressed in versions 0.1.17-11.el9, 0.1.17-11.fc42, 0.1.17-11.fc43, 0.1.17-11.fc44, 0.1.17-11.fc45
rust-num-conv - addressed in versions 0.2.0-1.el9, 0.2.0-1.el10_2, 0.2.0-1.fc42, 0.2.0-1.fc43, 0.2.0-1.fc44, 0.2.0-1.fc45
rust-sequoia-keystore-server - addressed in versions 0.2.0-6.el9, 0.2.0-6.fc42, 0.2.0-6.fc43, 0.2.0-6.fc44, 0.2.0-6.fc45
rust-eif_build - addressed in versions 0.2.1-6.el9, 0.2.1-6.fc42, 0.2.1-6.fc43, 0.2.1-6.fc44, 0.2.1-6.fc45
rust-ingredients - addressed in versions 0.2.2-2.fc42, 0.2.2-2.fc43, 0.2.2-2.fc44, 0.2.2-2.fc45
rust-pretty-git-prompt - addressed in versions 0.2.2-9.fc42, 0.2.2-9.fc43, 0.2.2-9.fc44, 0.2.2-9.fc45
rust-crypto-auditing-log-parser - addressed in versions 0.2.3-3.fc42, 0.2.4-2.fc43, 0.2.4-3.fc44, 0.2.4-3.fc45
rust-crypto-auditing-client - addressed in versions 0.2.3-5.fc42, 0.2.4-2.fc43, 0.2.4-3.fc44, 0.2.4-3.fc45
rust-crypto-auditing-event-broker - addressed in versions 0.2.3-6.fc42, 0.2.4-2.fc43, 0.2.4-3.fc44, 0.2.4-3.fc45
rust-crypto-auditing-agent - addressed in versions 0.2.3-6.fc42, 0.2.4-3.fc43, 0.2.4-4.fc44, 0.2.4-4.fc45
keylime-agent-rust - addressed in versions 0.2.8-10.fc42, 0.2.8-10.fc43, 0.2.8-11.fc44, 0.2.8-11.fc45
rust-time-macros - addressed in versions 0.2.27-1.el9, 0.2.27-1.el10_2, 0.2.27-1.fc42, 0.2.27-1.fc43, 0.2.27-1.fc44, 0.2.27-1.fc45
rust-busd - addressed in versions 0.3.1-6.fc42, 0.3.1-6.fc43, 0.3.1-6.fc44, 0.3.1-6.fc45
rust-oo7-cli - addressed in versions 0.3.3-5.fc42, 0.4.3-4.fc43, 0.4.3-4.fc44, 0.4.3-4.fc45
rust-time - addressed in versions 0.3.47-1.el9, 0.3.47-1.el10_2, 0.3.47-2.fc42, 0.3.47-2.fc43, 0.3.47-2.fc44, 0.3.47-2.fc45
rust-muvm - addressed in versions 0.4.1-5.fc42, 0.4.1-5.fc43, 0.4.1-5.fc44, 0.4.1-5.fc45
rust-monitord-exporter - addressed in versions 0.4.1-8.fc42, 0.4.1-8.fc43, 0.4.1-8.fc44, 0.4.1-8.fc45
rust-prometheus-client-derive-encode - update to 0.4.2-6.el9
sad - addressed in versions 0.4.32-4.fc42, 0.4.32-4.fc43, 0.4.32-4.fc44, 0.4.32-4.fc45
rust-sigul-pesign-bridge - addressed in versions 0.5.0-3.el9, 0.5.0-3.fc42, 0.5.0-3.fc43, 0.6.0-3.fc44, 0.6.0-3.fc45
rust-app-store-connect - addressed in versions 0.5.0-6.fc42, 0.5.0-6.fc43, 0.5.0-6.fc44, 0.5.0-6.fc45
rust-btrd - addressed in versions 0.5.3-12.el9, 0.5.3-12.fc42, 0.5.3-12.fc43, 0.5.3-12.fc44, 0.5.3-12.fc45
rust-scx_rusty - addressed in versions 0.5.4-7.el9, 0.5.4-7.fc42, 0.5.4-7.fc43, 0.5.4-7.fc44, 0.5.4-7.fc45
rust-pleaser - addressed in versions 0.5.6-6.fc42, 0.5.6-6.fc43, 0.5.6-6.fc44, 0.5.6-6.fc45
rust-add-determinism - addressed in versions 0.6.0-3.fc42, 0.6.0-3.fc43, 0.7.2-4.fc44, 0.7.2-4.fc45
rust-scx_utils - update to 0.6.0-6.el9
rust-sevctl - addressed in versions 0.6.2-6.fc42, 0.6.2-6.fc43, 0.6.2-6.fc44, 0.6.2-6.fc45
tbtools - addressed in versions 0.7.0-2.fc42, 0.7.0-2.fc43, 0.7.0-3.fc44, 0.7.0-3.fc45
rust-wiremix - addressed in versions 0.7.0-3.fc42, 0.7.0-3.fc43, 0.7.0-3.fc44, 0.7.0-3.fc45
rust-shadow-rs - addressed in versions 0.8.1-14.el9, 0.8.1-14.fc42, 0.8.1-14.fc43, 0.8.1-14.fc44, 0.8.1-14.fc45
rust-below - addressed in versions 0.9.0-6.el9, 0.9.0-6.el10_2, 0.9.0-6.fc42, 0.9.0-6.fc43, 0.9.0-6.fc44, 0.9.0-6.fc45
tuigreet - addressed in versions 0.9.1-7.fc42, 0.9.1-7.fc43, 0.9.1-7.fc44, 0.9.1-7.fc45
rust-snpguest - addressed in versions 0.9.2-4.fc43, 0.9.2-4.fc44, 0.9.2-4.fc45
uv - addressed in versions 0.9.30-2.el10_2, 0.9.30-2.fc42, 0.9.30-2.fc43, 0.9.30-2.fc44, 0.9.30-2.fc45
rust-rustyline-derive0.10 - update to 0.10.0-2.el9
greetd - addressed in versions 0.10.3-6.fc42, 0.10.3-6.fc43, 0.10.3-6.fc44, 0.10.3-6.fc45
rust-cargo-c - addressed in versions 0.10.14-2.el9, 0.10.18-3.el10_2, 0.10.18-3.fc42, 0.10.18-3.fc43, 0.10.18-3.fc44, 0.10.18-3.fc45
rust-sccache - addressed in versions 0.12.0-3.fc42, 0.13.0-3.fc43, 0.13.0-3.fc44, 0.13.0-3.fc45
bustle - addressed in versions 0.12.0-4.fc42, 0.13.0-4.fc43, 0.13.0-4.fc44, 0.13.0-4.fc45
rust-monitord - addressed in versions 0.12.1-6.fc42, 0.12.1-6.fc43, 0.12.1-6.fc44, 0.12.1-6.fc45
rust-sequoia-chameleon-gnupg - addressed in versions 0.13.1-9.fc42, 0.13.1-9.fc43, 0.13.1-9.fc44, 0.13.1-9.fc45
rust-gst-plugin-reqwest - addressed in versions 0.13.3-4.fc42, 0.14.3-3.fc43, 0.14.3-3.fc44, 0.14.3-3.fc45
rust-gst-plugin-dav1d - addressed in versions 0.13.7-2.fc42, 0.14.0-3.fc43, 0.14.0-3.fc44, 0.14.0-3.fc45
rust-routinator - addressed in versions 0.14.2-4.el9, 0.14.2-4.el10_2, 0.14.2-4.fc42, 0.14.2-4.fc43, 0.14.2-4.fc44, 0.14.2-4.fc45
rust-procs - addressed in versions 0.14.10-7.el9, 0.14.10-7.fc42, 0.14.10-7.fc43, 0.14.10-7.fc44, 0.14.10-7.fc45
rust-git-delta - addressed in versions 0.18.2-13.fc42, 0.18.2-13.fc43, 0.18.2-13.fc44, 0.18.2-13.fc45
rust-cargo-deny - addressed in versions 0.18.9-4.fc42, 0.18.9-4.fc43, 0.18.9-4.fc44, 0.18.9-4.fc45
rust-prometheus-client - update to 0.19.0-6.el9
rust-git2 - addressed in versions 0.20.4-1.el9, 0.20.4-1.el10_2, 0.20.4-1.fc42, 0.20.4-1.fc43, 0.20.4-1.fc44, 0.20.4-1.fc45
rust-bat - addressed in versions 0.24.0-12.el9, 0.24.0-13.el10_2, 0.25.0-9.fc42, 0.25.0-9.fc43, 0.25.0-9.fc44, 0.25.0-9.fc45
rust-coreos-installer - addressed in versions 0.25.0-4.fc42, 0.25.0-4.fc43, 0.25.0-4.fc44, 0.25.0-4.fc45
rust-gitui - addressed in versions 0.28.0-3.fc44, 0.28.0-3.fc45
rust-rbspy - addressed in versions 0.34.1-4.fc42, 0.34.1-4.fc43, 0.34.1-4.fc44, 0.34.1-4.fc45
rust-redlib - addressed in versions 0.35.1-10.fc42, 0.35.1-10.fc43, 0.35.1-10.fc44, 0.35.1-10.fc45
rust-nu - addressed in versions 0.99.1-16.el9, 0.99.1-16.fc42, 0.99.1-16.fc43, 0.99.1-16.fc44, 0.99.1-16.fc45
rust-speakersafetyd - addressed in versions 1.0.2-6.el10_2, 1.0.2-6.fc42, 1.0.2-6.fc43, 1.0.2-6.fc44, 1.0.2-6.fc45
rust-dtoa - update to 1.0.11-2.el9
rust-lsd - addressed in versions 1.2.0-3.fc42, 1.2.0-3.fc43, 1.2.0-3.fc44, 1.2.0-3.fc45
glycin - addressed in versions 1.2.3-6.fc42, 2.0.5-4.fc43, 2.0.5-4.fc44, 2.0.5-4.fc45
rust-sequoia-sq - addressed in versions 1.3.1-10.el9, 1.3.1-10.fc42, 1.3.1-10.fc43, 1.3.1-10.fc44, 1.3.1-10.fc45
ntpd-rs - addressed in versions 1.6.2-3.el10_2, 1.6.2-3.fc42, 1.6.2-3.fc43, 1.6.2-3.fc44, 1.6.2-3.fc45
rust-tealdeer - addressed in versions 1.7.2-4.fc42, 1.7.2-4.fc43, 1.7.2-4.fc44, 1.7.2-4.fc45
rust-heatseeker - addressed in versions 1.7.3-4.fc42, 1.7.3-4.fc43, 1.7.3-4.fc44, 1.7.3-4.fc45
maturin - addressed in versions 1.9.6-3.el10_2, 1.9.6-3.fc42, 1.9.6-4.fc43, 1.9.6-4.fc44, 1.9.6-4.fc45
rust-bytes - addressed in versions 1.11.1-1.el9, 1.11.1-1.el10_2, 1.11.1-1.fc42, 1.11.1-1.fc43, 1.11.1-1.fc44, 1.11.1-1.fc45
rust-sequoia-octopus-librnp - addressed in versions 1.11.1-5.fc42, 1.11.1-5.fc43, 1.11.1-5.fc44, 1.11.1-5.fc45
rust-rbw - addressed in versions 1.13.2-5.el9, 1.13.2-5.el10_2, 1.13.2-5.fc42, 1.13.2-5.fc43, 1.13.2-5.fc44, 1.13.2-5.fc45
rustup - addressed in versions 1.28.2-8.fc42, 1.28.2-8.fc43, 1.28.2-8.fc44, 1.28.2-8.fc45
rust-resctl-demo - addressed in versions 2.2.5-9.el9, 2.2.5-9.fc42, 2.2.5-9.fc43, 2.2.5-9.fc44, 2.2.5-9.fc45
rust-rd-hashd - addressed in versions 2.2.5-10.el9, 2.2.5-10.fc42, 2.2.5-10.fc43, 2.2.5-10.fc44, 2.2.5-10.fc45
rust-resctl-bench - addressed in versions 2.2.5-10.el9, 2.2.5-10.fc42, 2.2.5-10.fc43, 2.2.5-10.fc44, 2.2.5-10.fc45
rust-rd-agent - addressed in versions 2.2.5-14.el9, 2.2.5-14.fc42, 2.2.5-14.fc43, 2.2.5-14.fc44, 2.2.5-14.fc45
rust-git-interactive-rebase-tool - addressed in versions 2.4.1-15.fc42, 2.4.1-15.fc43, 2.4.1-15.fc44, 2.4.1-15.fc45
rust-onefetch - addressed in versions 2.26.1-7.el9, 2.26.1-7.el10_2, 2.26.1-7.fc42, 2.26.1-7.fc43, 2.26.1-7.fc44, 2.26.1-7.fc45
rust-dua-cli - addressed in versions 2.32.2-3.el9, 2.32.2-3.fc42, 2.32.2-3.fc43, 2.32.2-3.fc44, 2.32.2-3.fc45
asciinema - addressed in versions 3.0.0-5.fc43, 3.0.0-5.fc44, 3.0.0-5.fc45
mirrorlist-server - addressed in versions 3.0.8-3.fc42, 3.0.8-3.fc43, 3.0.8-3.fc44, 3.0.8-3.fc45
envision - addressed in versions 3.2.0-7.fc42, 3.2.0-7.fc43, 3.2.0-7.fc44, 3.2.0-7.fc45
rust-pom - update to 3.4.0-5.el9
rust-afterburn - addressed in versions 5.10.0-3.fc42, 5.10.0-3.fc43, 5.10.0-3.fc44, 5.10.0-3.fc45
rust-jsonwebtoken - addressed in versions 9.3.1-4.el10_2, 9.3.1-4.fc42, 9.3.1-4.fc43, 9.3.1-4.fc44, 9.3.1-4.fc45
rust-rustyline14 - update to 14.0.0-2.el9
rust-tokei - addressed in versions 14.0.0-4.el9, 14.0.0-4.el10_2, 14.0.0-4.fc42, 14.0.0-4.fc43, 14.0.0-4.fc44, 14.0.0-4.fc45
atuin - addressed in versions 18.6.1-10.el9, 18.6.1-10.fc42, 18.6.1-10.fc43, 18.6.1-10.fc44, 18.6.1-10.fc45
helix - addressed in versions 25.07.1-7.el9, 25.07.1-7.el10_2, 25.07.1-7.fc42, 25.07.1-7.fc43, 25.07.1-7.fc44, 25.07.1-7.fc45

• https://github.com/Keats/jsonwebtoken/commit/abbc3076742c4161347bc6b8bf4aa5eb86e1dc01
• https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc

• Authentication bypass in JWT lib in rust
• Fedora 45 update for asciinema, atuin, bustle, envision, glycin, greetd, helix, keylime-agent-rust, maturin, mirrorlist-server, ntpd-rs, rust-add-determinism, rust-afterburn, rust-app-store-connect, rust-bat, rust-below, rust-btrd, rust-busd, rust-bytes,
• Fedora 44 update for asciinema, atuin, bustle, envision, glycin, greetd, helix, keylime-agent-rust, maturin, mirrorlist-server, ntpd-rs, rust-add-determinism, rust-afterburn, rust-app-store-connect, rust-bat, rust-below, rust-btrd, rust-busd, rust-bytes,
• Fedora 43 update for asciinema, atuin, bustle, envision, glycin, greetd, helix, keylime-agent-rust, maturin, mirrorlist-server, ntpd-rs, rust-add-determinism, rust-afterburn, rust-ambient-id, rust-app-store-connect, rust-bat, rust-below, rust-btrd, rust-b
• Fedora 42 update for atuin, bustle, envision, glycin, greetd, helix, keylime-agent-rust, maturin, mirrorlist-server, ntpd-rs, rust-add-determinism, rust-afterburn, rust-ambient-id, rust-app-store-connect, rust-bat, rust-below, rust-btrd, rust-busd, rust-b
• Fedora EPEL 10.2 update for helix, maturin, ntpd-rs, rust-ambient-id, rust-bat, rust-below, rust-bytes, rust-cargo-c, rust-git2, rust-jsonwebtoken, rust-num-conv, rust-onefetch, rust-rbw, rust-routinator, rust-speakersafetyd, rust-time, rust-time-core, ru
• Fedora EPEL 9 update for atuin, helix, rust-bat, rust-below, rust-btrd, rust-bytes, rust-cargo-c, rust-dtoa, rust-dua-cli, rust-eif_build, rust-git2, rust-nu, rust-num-conv, rust-onefetch, rust-pom, rust-pore, rust-procs, rust-prometheus-client, rust-prom