Input validation error in lua-resty-jwt - #VU163199
Published: November 9, 2026
Vulnerability identifier: #VU163199
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass token revocation, replay prevention, or rate limits in applications that identify tokens by their raw string or its hash.
The vulnerability exists due to lenient compact-serialization parsing in lua-resty-jwt that accepts noncanonical segment structures and encodings during verification. An unauthenticated remote attacker can re-encode a previously valid token into a different string that still verifies, evading checks for revoked or already-used tokens.
Affected software
lua-resty-jwt
Remediation
Install security update from vendor's website.
lua-resty-jwt - update to 0.4.0