PT-2026-67225 · Unknown · Ueberauth Guardian
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
ueberauth guardian versions 1.0.0 through 2.4.0
Description
Improper verification of cryptographic signatures allows an unauthenticated attacker to revoke a victim's session using a forged token. The
Guardian.revoke/3 function in lib/guardian.ex uses peek/1 to decode tokens, which only performs base64-decoding of the JWT header and payload without verifying the signature. These unverified claims are then passed to the token module's revoke callback and the on revoke callback, which can mutate state. An attacker who knows or guesses identifying claim values such as jti or sub can forge a JWT and submit it to endpoints that use Guardian.revoke/3, leading to a denial of service where the victim's legitimate session is evicted. This occurs when the token module mutates state based on these claims, such as in whitelist deletions or blacklist insertions.Recommendations
Update ueberauth guardian to version 2.4.1 or later.
As a temporary workaround, call
decode and verify on the caller-supplied token to validate the signature before passing it into Guardian.revoke/3, and reject tokens with invalid signatures at the application boundary.Exploit
Fix
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ueberauth Guardian