PT-2025-39697 · Get-Jwks · Get-Jwks

Published 2025-09-26 · Updated 2025-09-28 · CVE-2025-59936

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions get-jwks versions prior to 11.0.2

Description A flaw exists in the get-jwks library related to its JWKS key-fetching mechanism. When the issuer (iss) claim is validated after keys are retrieved from the cache, cached keys from an unexpected issuer can be reused, bypassing issuer validation. This allows a malicious actor to craft JWTs, first ensuring a chosen public key is cached, and then leveraging that cached key to pass signature validation for a targeted issuer. The vulnerability occurs when issuer validation is performed after using get-jwks to retrieve keys, which is a common configuration. The issue involves the construction of cache keys, which can lead to collisions and allow attackers to control the key used for signature verification.

Recommendations Update to get-jwks version 11.0.2 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2025-59936

GHSA-QC2Q-QHF3-235M

Affected Products

Get-Jwks

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59936.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59936 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qc2q-qhf3-235m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59936 · Security Note
• https://github.com/nearform/get-jwks/commit/1706a177a80a1759fe68e3339dc5a219ce03ddb9 · Note
• https://github.com/nearform/get-jwks/security/advisories/GHSA-qc2q-qhf3-235m · Note
• https://github.com/nearform/get-jwks · Note
• https://t.me/CVEtracker/33512 · Telegram Post
• https://twitter.com/CveFindCom/status/1971744056808980645 · Twitter Post
• https://t.me/cveNotify/136671 · Telegram Post
• https://twitter.com/0dayPublishing/status/1972338452088713634 · Twitter Post