PT-2026-41315 · Libjwt · Libjwt

Published 2026-05-15 · Updated 2026-05-20 · CVE-2026-44699

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LibJWT versions 3.0.0 through 3.3.2

Description LibJWT accepts an RSA JSON Web Key (JWK) lacking an alg parameter as the verification key for HS256, HS384, or HS512 tokens. When using the OpenSSL backend, this results in HMAC verification executing with a zero-length key, enabling an attacker to forge valid JSON Web Tokens (JWT) without possessing a secret or RSA private key. This is an algorithm-confusion authentication bypass that impacts applications loading RSA keys from JWKS where the alg parameter is omitted and the verification algorithm is selected based on the JWT header, such as within a kid lookup callback.

Recommendations Update LibJWT to version 3.3.3.

Exploit

Fix

Improper Verification of Cryptographic Signature

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-347

CWE-327

Related Identifiers

CVE-2026-44699

GHSA-Q843-6Q5F-W55G

Affected Products

Libjwt

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44699.json · Exploit
• 🔥 https://github.com/benmcollins/libjwt/security/advisories/GHSA-q843-6q5f-w55g · Exploit
• https://ubuntu.com/security/CVE-2026-44699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44699 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-44699 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44699 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44699 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44699 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44699 · Vendor Advisory
• https://i.redd.it/m4geilbzzb2h1.png · Reddit Post
• https://t.me/cveNotify/163913 · Telegram Post
• https://t.me/CVEtracker/53931 · Telegram Post