Improper Verification of Cryptographic Signature Affecting io.jsonwebtoken:jjwt package, versions [0,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IOJSONWEBTOKEN-21181502
- published18 Oct 2026
- disclosed27 Sept 2026
- creditUnknown
Introduced: 27 Sep 2026
New CVE NOT AVAILABLE CWE-347 (opens in a new tab)How to fix?
There is no fixed version for io.jsonwebtoken:jjwt.
Overview
Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the parse() method of DefaultJwtParser, whose verification block is entered only when base64UrlEncodedDigest != null, so a token with a trailing dot and no third segment skips it regardless of a configured key, keyBytes, or signingKeyResolver. An attacker can authenticate as any subject by submitting an unsigned token, which is returned as a DefaultJwt with the supplied claims.
Note: Methods that require a signed JWT, like parseClaimsJws, are not vulnerable.