CVE-2026-25537: jsonwebtoken has Type Confusion that leads to potential authorization bypass

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-04 · updated 2026-06-17
Weakness: CWE-843

Description

jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks the claim as “FailedToParse”. Crucially, the validation logic treats this “FailedToParse” state identically to “NotPresent”. This means that if a check is enabled (like: validate_nbf = true), but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim, treating it as if it were not there. This allows attackers to bypass critical time-based security restrictions (like “Not Before” checks) and commit potential authentication and authorization bypasses. This issue has been patched in version 10.3.0.

Affected products

Keats jsonwebtoken: before 10.3.0 — fixed in 10.3.0

How to fix

Upgrade to a fixed version: Keats jsonwebtoken 10.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-25537 or the next vulnerability affects your stack