PT-2026-30016 · Pypi · Fast-Jwt

Fasrm · Published 2026-04-03 · Updated 2026-04-08 · CVE-2026-35039

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions fast-jwt (affected versions not specified)

Description The fast-jwt library has a cache confusion vulnerability that can lead to identity or authorization mix-ups. This occurs when a custom cacheKeyBuilder function does not create unique keys for different tokens, leading to cache collisions. This can result in valid tokens returning claims from different tokens, user impersonation, privilege escalation, cross-tenant data access, and authorization bypass. The vulnerability only affects applications that enable caching and use custom cacheKeyBuilder functions prone to collisions. Examples of vulnerable configurations include those that group by audience, user type, or tenant and service. Safe configurations include using the default hash-based caching or disabling caching altogether. The parseToken function is used within the cacheKeyBuilder function.

Recommendations Ensure uniqueness of keys produced in the cacheKeyBuilder function. Remove the custom cacheKeyBuilder function. Disable caching.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-706

CWE-1289

CWE-345

Related Identifiers

CVE-2026-35039

GHSA-RP9M-7R4C-75QG

Affected Products

Fast-Jwt

References · 11

• https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb · Patch
• https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35039 · Security Note
• https://osv.dev/vulnerability/GHSA-rp9m-7r4c-75qg · Vendor Advisory
• https://github.com/nearform/fast-jwt · Note
• https://twitter.com/vulert_official/status/2040077652057563370 · Twitter Post
• https://twitter.com/CVEnew/status/2041223965046083967 · Twitter Post
• https://twitter.com/CveFindCom/status/2041210150111912092 · Twitter Post
• https://t.me/cveNotify/158439 · Telegram Post
• https://twitter.com/0dayPublishing/status/2041201649968963663 · Twitter Post
• https://twitter.com/pulsepatchio/status/2040080439059116058 · Twitter Post