PT-2026-26212 · Simplejwt · Simplejwt

Edoardottt · Published 2026-03-18 · Updated 2026-03-21 · CVE-2026-33204

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SimpleJWT versions prior to 1.1.1

Description A flaw exists in SimpleJWT that allows an unauthenticated attacker to cause a denial of service through manipulation of the JWE header when PBES2 algorithms are used. Specifically, the vulnerability stems from a lack of input validation on the iteration count (p2c parameter) within the PBES2 algorithm. An attacker can supply a very large value for the p2c parameter, leading to excessive CPU consumption during key derivation via the hash pbkdf2() function. This can exhaust server resources and render the application unavailable. The vulnerable code resides in the decryptKey() and generateKeyFromPassword() functions of the PBES2.php file. The attack can be triggered even with an invalid JWE, as authentication is not required before processing the header. A proof of concept demonstrates the ability to shut down a PHP development server by sending a crafted JWE with a high p2c value.

Recommendations Update to SimpleJWT version 1.1.1 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-33204

GHSA-XW36-67F8-339X

Affected Products

Simplejwt

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33204.json · Exploit
• https://github.com/kelvinmo/simplejwt/security/advisories/GHSA-xw36-67f8-339x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33204 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xw36-67f8-339x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33204 · Security Note
• https://github.com/kelvinmo/simplejwt · Note
• https://github.com/kelvinmo/simplejwt/releases/tag/v1.1.1 · Note
• https://twitter.com/CVEnew/status/2035262135442329789 · Twitter Post