CVE-2026-25537 jsonwebtoken has Type Confusion that leads to potential authorization bypass
Attackers can bypass time-based validation checks by providing malformed claims, leading to potential authentication and authorization bypasses in applications using this Rust library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25537?
CVE-2026-25537 is a medium-severity authentication bypass vulnerability in Keats jsonwebtoken, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks the claim as “FailedToParse”. Crucially, the validation logic treats this “FailedToParse” state identically to “NotPresent”. This means that if a check is enabled (like: validate_nbf = true), but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim, treating it as if it were not there. This allows attackers to bypass critical time-based security restrictions (like “Not Before” checks) and commit potential authentication and authorization bypasses. This issue has been patched in version 10.3.0.
Weakness: CWE-843
Which versions are affected by CVE-2026-25537?
2 open source packages ship an affected version, including jsonwebtoken. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jsonwebtoken crates.io | All versions | 10.3.0 |
jsonwebtoken crates.io | All versions | 10.3.0 |
Products include Keats Jsonwebtoken.
How do I fix CVE-2026-25537?
Upgrade jsonwebtoken to 10.3.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-25537 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25537 exists.
Sources
Also known as DEBIAN-CVE-2026-25537, GHSA-h395-gr6q-cpjc, MINI-38hc-f2v8-hmc9, MINI-8f84-f7h5-3vmc, MINI-g969-x52j-vcq4, UBUNTU-CVE-2026-25537.