Improper Verification of Cryptographic Signature Affecting io.jsonwebtoken:jjwt-impl package, versions [,0.12.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IOJSONWEBTOKEN-21181501
- published18 Oct 2026
- disclosed27 Sept 2026
- creditUnknown
Introduced: 27 Sep 2026
New CVE NOT AVAILABLE CWE-347 (opens in a new tab)How to fix?
Upgrade io.jsonwebtoken:jjwt-impl to version 0.12.0 or higher.
Overview
Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the parse() method of DefaultJwtParser, whose verification block is entered only when base64UrlEncodedDigest != null, so a token with a trailing dot and no third segment skips it regardless of a configured key, keyBytes, or signingKeyResolver. An attacker can authenticate as any subject by submitting an unsigned token, which is returned as a DefaultJwt with the supplied claims.
Note: Methods that require a signed JWT, like parseClaimsJws, are not vulnerable.