PT-2025-11698 · Fast-Jwt · Fast-Jwt
Published
2025-03-19
·
Updated
2025-07-08
·
CVE-2025-30144
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
fast-jwt versions prior to 5.0.6
Description
The fast-jwt library does not properly validate the
iss claim based on the RFC 7519, allowing an array of strings as a valid iss value. This enables a potential attack where a malicious actor crafts a JWT with an iss claim structured as an array containing both malicious and legitimate issuer domains. The permissive validation deems the JWT valid, and if the application relies on external libraries that do not independently validate the iss claim, the attacker can forge a JWT that will be accepted by the victim application.Recommendations
For versions prior to 5.0.6, update to version 5.0.6 to fix the issue. As a temporary workaround, consider validating the
iss claim independently in your application to ensure it matches the expected issuer domain, and restrict the use of external libraries that do not perform this validation.Exploit
Fix
Insufficient Verification of Data Authenticity
Authentication Bypass by Spoofing
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fast-Jwt