CVE-2026-44699

{
  "id": "CVE-2026-44699",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-15T17:16:47.783",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3."
    },
    {
      "lang": "es",
      "value": "LibJWT es una biblioteca C de JSON Web Token. Desde la versión 3.0.0 hasta la 3.3.2, libjwt acepta una JWK RSA que no contiene un parámetro ’alg’ como clave de verificación para un token HS256/HS384/HS512. En el backend de OpenSSL, esto provoca que la verificación HMAC se ejecute con una clave de longitud cero, por lo que un atacante puede falsificar un JWT válido sin conocer ningún secreto o clave privada RSA. Esto es una omisión de autenticación por confusión de algoritmo. Afecta a las aplicaciones que cargan claves RSA de JWKS donde se omite ’alg’, lo cual es una sintaxis JWK válida y común en implementaciones reales, y luego eligen el algoritmo de verificación del encabezado JWT, por ejemplo, en una devolución de llamada de búsqueda de ’kid’. Esta vulnerabilidad está corregida en la versión 3.3.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "benmcollins",
          "product": "libjwt",
          "versions": [
            {
              "version": ">= 3.0.0, < 3.3.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T18:00:54.375359Z",
          "id": "CVE-2026-44699",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        },
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/benmcollins/libjwt/security/advisories/GHSA-q843-6q5f-w55g",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/benmcollins/libjwt/security/advisories/GHSA-q843-6q5f-w55g",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}