CVE-2026-44699

LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3.

CVSS

No CVSS.

References

Link	Resource
https://github.com/benmcollins/libjwt/security/advisories/GHSA-q843-6q5f-w55g
https://github.com/benmcollins/libjwt/security/advisories/GHSA-q843-6q5f-w55g

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) LibJWT es una biblioteca C de JSON Web Token. Desde la versión 3.0.0 hasta la 3.3.2, libjwt acepta una JWK RSA que no contiene un parámetro ’alg’ como clave de verificación para un token HS256/HS384/HS512. En el backend de OpenSSL, esto provoca que la verificación HMAC se ejecute con una clave de longitud cero, por lo que un atacante puede falsificar un JWT válido sin conocer ningún secreto o clave privada RSA. Esto es una omisión de autenticación por confusión de algoritmo. Afecta a las aplicaciones que cargan claves RSA de JWKS donde se omite ’alg’, lo cual es una sintaxis JWK válida y común en implementaciones reales, y luego eligen el algoritmo de verificación del encabezado JWT, por ejemplo, en una devolución de llamada de búsqueda de ’kid’. Esta vulnerabilidad está corregida en la versión 3.3.3.

Information

Published : 2026-05-15 17:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44699

Mitre link : CVE-2026-44699

CVE.ORG link : CVE-2026-44699

JSON object : View

Products Affected

No product.

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-44699", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44699", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T18:00:54.375359Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "benmcollins", "product": "libjwt", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.3"}]}]}], "published": "2026-05-15T17:16:47.783", "references": [{"url": "https://github.com/benmcollins/libjwt/security/advisories/GHSA-q843-6q5f-w55g", "source": "security-advisories@github.com"}, {"url": "https://github.com/benmcollins/libjwt/security/advisories/GHSA-q843-6q5f-w55g", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3."}, {"lang": "es", "value": "LibJWT es una biblioteca C de JSON Web Token. Desde la versi\u00f3n 3.0.0 hasta la 3.3.2, libjwt acepta una JWK RSA que no contiene un par\u00e1metro \u2019alg\u2019 como clave de verificaci\u00f3n para un token HS256/HS384/HS512. En el backend de OpenSSL, esto provoca que la verificaci\u00f3n HMAC se ejecute con una clave de longitud cero, por lo que un atacante puede falsificar un JWT v\u00e1lido sin conocer ning\u00fan secreto o clave privada RSA. Esto es una omisi\u00f3n de autenticaci\u00f3n por confusi\u00f3n de algoritmo. Afecta a las aplicaciones que cargan claves RSA de JWKS donde se omite \u2019alg\u2019, lo cual es una sintaxis JWK v\u00e1lida y com\u00fan en implementaciones reales, y luego eligen el algoritmo de verificaci\u00f3n del encabezado JWT, por ejemplo, en una devoluci\u00f3n de llamada de b\u00fasqueda de \u2019kid\u2019. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 3.3.3."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}