Observable discrepancy in lua-resty-jwt - #VU163203
Published: November 9, 2026
Vulnerability identifier: #VU163203
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-203
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to recover plaintext from encrypted JWE tokens through a padding/decryption oracle.
The vulnerability exists due to lua-resty-jwt decrypting AES-CBC-HMAC ciphertext and validating claims before checking the authentication tag. An unauthenticated remote attacker can submit modified tokens to an application that exposes validation failure reasons and use distinguishable errors to infer encrypted token contents.
Affected software
lua-resty-jwt
Remediation
Install security update from vendor's website.
lua-resty-jwt - update to 0.4.0