Description

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-03T21:17:22.687Z",
  "pubdate": "2026-09-03T21:17:22.687Z",
  "executiveSummary": "The jwcrypto library suffers from an improper authorization vulnerability in the handling of General JSON Serialization JWS signatures.\nThe vulnerability occurs when verifying signatures against a provided set of keys, where the library fails to enforce matching between the intended key ID (kid) and the signing key used.\nThis flaw allows an attacker possessing a valid key within the provided set to bypass authorization checks, effectively masquerading as a different user or tenant who might otherwise be restricted to a specific key.\nThe impact is significant for multi-tenant or multi-user applications that rely on the 'kid' header parameter as a security boundary to enforce identity isolation.\nSuccessful exploitation requires the attacker to hold at least one legitimate key within the target key set; however, no specific elevated privileges are required to initiate the attack, as it exploits the logic governing how the library parses and validates the JOSE header against the available keystore.\nThis represents a failure in cryptographic binding where the security of the signature verification process is decoupled from the required identity context provided by the key ID header.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic governing signature verification for General JSON Serialization JWS inputs within jwcrypto. When multiple keys are provided for validation, the library attempts to iterate through the key set to verify the cryptographic integrity of the signature.\nIdeally, the library should first extract the 'kid' (Key ID) header from the JOSE header of the JWS object and match it against the keys in the provided set. If a match is found, the library should verify the signature exclusively using that identified key. Instead, the implementation fails to enforce this strict mapping.\nThe attack flow begins when an attacker, who may possess their own legitimate key within the system's broader keystore, crafts a malicious JWS token. Even if the attacker specifies a 'kid' header belonging to a target victim, the library's verification logic ignores the constraint of the 'kid' header. If any other key in the provided set is technically capable of satisfying the signature verification, or if the logic erroneously defaults to a 'first-match' verification strategy regardless of the 'kid' header value, the signature is deemed valid.\nBecause the library does not explicitly discard keys that do not correspond to the provided 'kid' parameter, an attacker can substitute the 'kid' value to point to a legitimate target and sign the payload with their own valid key. The verification engine, failing to perform an identity check against the header, proceeds to validate the signature using the attacker-supplied key or another key in the set, leading to a successful verification.\nThis flaw allows for unauthorized access to protected resources. Applications relying on jwcrypto to confirm the identity of a requester based on the 'kid' parameter are susceptible to identity spoofing. In a multi-tenant environment, an attacker could supply a 'kid' belonging to a high-privileged entity and, if they have an active key elsewhere in the system, bypass the application's authorization logic.\nThe vulnerability resides in the core verification logic of the jwcrypto library responsible for parsing the General JSON Serialization structure. This logic must be updated to strictly compare the 'kid' header parameter against the candidate signing key's metadata before proceeding with signature validation operations. Without this strict enforcement, the cryptographic layer is decoupled from the application-level security requirement of user or tenant identification."
}