Improper Verification of Cryptographic Signature in lua-resty-jwt - #VU163201
Published: November 9, 2026
Vulnerability identifier: #VU163201
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to forge arbitrary JSON Web Tokens that affected applications accept as valid.
The vulnerability exists due to algorithm confusion in lua-resty-jwt when applications verify tokens using an RSA or EC public key without configuring an algorithm whitelist. An unauthenticated remote attacker can select an HMAC algorithm in the token header and sign forged tokens using the public key's PEM text as the secret.
Affected software
lua-resty-jwt
Remediation
Install security update from vendor's website.
lua-resty-jwt - update to 0.4.0