jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks the claim as “FailedToParse”. Crucially, the validation logic treats this “FailedToParse” state identically to “NotPresent”. This means that if a check is enabled (like: validate_nbf = true), but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim, treating it as if it were not there. This allows attackers to bypass critical time-based security restrictions (like “Not Before” checks) and commit potential authentication and authorization bypasses. This issue has been patched in version 10.3.0.
CVE-2026-25537 is a type confusion vulnerability in the Rust jsonwebtoken library that allows attackers to bypass JWT claim validation by providing claims with incorrect JSON types. This enables circumvention of critical time-based security checks like 'Not Before' (nbf) and expiration (exp) validations, potentially leading to authentication and authorization bypasses.
تحتوي مكتبة jsonwebtoken في Rust على ثغرة التباس نوعي تؤثر على منطق التحقق من المطالبات. عندما يتم توفير مطالبة قياسية بنوع JSON غير صحيح، تعامل المكتبة الحالة على أنها غير موجودة بدلاً من معالجتها كخطأ، مما يسمح بتجاوز فحوصات الأمان المستندة إلى الوقت.
A type confusion flaw in jsonwebtoken library versions before 10.3.0 permits attackers to bypass JWT validation by submitting malformed claims, potentially compromising authentication mechanisms in systems relying on this library for token verification.
Immediately upgrade jsonwebtoken to version 10.3.0 or later. Review all JWT validation configurations to ensure required_spec_claims is properly configured for critical claims. Implement additional server-side validation of token timestamps and implement strict input validation for JWT claims.
قم بترقية مكتبة jsonwebtoken إلى الإصدار 10.3.0 أو أحدث فوراً. راجع جميع إعدادات التحقق من JWT للتأكد من تكوين required_spec_claims بشكل صحيح للمطالبات الحرجة. طبق التحقق الإضافي من جانب الخادم لطوابع زمن التوكن وتحقق صارم من مدخلات مطالبات JWT.