{"answers":{"affected":"2 open source packages ship an affected version, including github.com/beatt83/jose-swift.","exploited":"There is no known exploitation of GHSA-88q6-jcjg-hvmw in the wild and no public exploit code.","fix":"Upgrade github.com/beatt83/jose-swift to 6.0.2 or later.","what":"GHSA-88q6-jcjg-hvmw is an authentication bypass vulnerability in github.com/beatt83/jose-swift, published on 9 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-88q6-jcjg-hvmw and fix it if it is affected.\n\nWhat it is: GHSA-88q6-jcjg-hvmw is an authentication bypass vulnerability in github.com/beatt83/jose-swift, published on 9 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-88q6-jcjg-hvmw in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/beatt83/jose-swift (SwiftURL): affected all versions; fixed in 6.0.2\n- github.com/beatt83/jose-swift (SwiftURL): affected all versions; fixed in 6.0.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-88q6-jcjg-hvmw/ (Markdown: https://insights.sbomify.com/GHSA-88q6-jcjg-hvmw/index.md)","id":"GHSA-88q6-jcjg-hvmw","markdown":"https://insights.sbomify.com/GHSA-88q6-jcjg-hvmw/index.md","name":"GHSA-88q6-jcjg-hvmw","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["privilege_escalation","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Swift JWT library","requires_auth":"none","summary":"Unauthenticated attackers can forge JWT tokens using the 'none' algorithm to bypass signature verification, enabling user impersonation and privilege escalation.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nAn authentication bypass vulnerability allows any unauthenticated attacker to forge arbitrary JWT tokens by setting \"alg\": \"none\" in the token header. The library's verification functions immediately return `true` for such tokens without performing any cryptographic verification, enabling complete impersonation of any user and privilege escalation.\n\n### Details\n  The vulnerability exists in Sources/JSONWebSignature/JWS+Verify.swift at lines 34-37:\n\n```\n  public func verify\u003cKey\u003e(key: Key?) throws -\u003e Bool {\n      guard SigningAlgorithm.none != protectedHeader.algorithm else {\n          return true  // \u003c-- Vulnerability: returns true without verification\n      }\n```\n  When the JWT header contains \"alg\": \"none\", the verify() method returns true immediately without:\n  1. Checking if the signature is empty or present\n  2. Validating the token against any key\n  3. Requiring explicit opt-in from the caller\n  \n\n The SigningAlgorithm enum in Sources/JSONWebAlgorithms/Signatures/SigningAlgorithm.swift:72 explicitly includes case none = \"none\" as a valid algorithm.\n\n  All verification methods are affected:\n  - JWS.verify(key:) - Instance method\n  - JWS.verify(jwsString:payload:key:) - Static method\n  - JWT.verify(jwtString:senderKey:) - High-level API\n\n### PoC\n\n  1. Create a forged JWT with modified claims:\n  // Forged header with alg:none\n  let header = #\"{\"alg\":\"none\",\"typ\":\"JWT\"}\"#\n\n  // Attacker's payload with escalated privileges\n  let payload = #\"{\"sub\":\"user123\",\"admin\":true}\"#\n\n  // Base64URL encode and concatenate with empty signature\n  let forgedToken = base64url(header) + \".\" + base64url(payload) + \".\"\n  // Result: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ1c2VyMTIzIiwiYWRtaW4iOnRydWV9.\n\n  2. Verify the forged token passes verification:\n  let jws = try JWS(jwsString: forgedToken)\n  let isValid = try jws.verify(key: legitimateSecretKey)  // Returns TRUE\n\n### Impact\n\n  This is an authentication bypass vulnerability.   Who is impacted: Any application using jose-swift for JWT verification is vulnerable. An attacker can:\n\n  - Forge identity: Create tokens claiming to be any user\n  - Escalate privileges: Add admin/superuser claims to gain unauthorized access\n  - Bypass authentication entirely: Access protected resources without valid credentials\n  - Modify any claim: Change expiration, audience, issuer, or any custom claims\n\n  The attack requires no knowledge of the signing key and works against all signature algorithms (HS256, RS256, ES256, etc.) since the attacker simply bypasses signature verification entirely.\n\n### Credits\nReported by Louis Nyffenegger - https://pentesterlab.com/","ecosystems":["SwiftURL"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"jose-swift has JWT Signature Verification Bypass via None Algorithm","id":"GHSA-88q6-jcjg-hvmw","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"SwiftURL","product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"SwiftURL","fixed":["6.0.2"],"introduced":["0"],"last_affected":[],"package":"github.com/beatt83/jose-swift","purl":null,"source":"GHSA-88q6-jcjg-hvmw"},{"ecosystem":"SwiftURL","fixed":["6.0.2"],"introduced":["0"],"last_affected":[],"package":"github.com/beatt83/jose-swift","purl":"pkg:swift/github.com/beatt83/jose-swift","source":"GHSA-88q6-jcjg-hvmw"}],"products":null,"published":"2026-01-09","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unauthenticated attackers can forge JWT tokens using the 'none' algorithm to bypass signature verification, enabling user impersonation and privilege escalation.","url":"https://insights.sbomify.com/GHSA-88q6-jcjg-hvmw/"}