Use of a Broken or Risky Cryptographic Algorithm Affecting github.com/beatt83/jose-swift package, versions <6.0.2
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Use of a Broken or Risky Cryptographic Algorithm vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-SWIFT-BEATT83JOSESWIFT-14912610
- published11 Jan 2026
- disclosed9 Jan 2026
- creditLouis Nyffenegger
Introduced: 9 Jan 2026
CVE NOT AVAILABLE CWE-327 (opens in a new tab)How to fix?
Upgrade beatt83/jose-swift to version 6.0.2 or higher.
Overview
beatt83/jose-swift is a comprehensive support for the Jose suite of standards, including JWA (JSON Web Algorithms), JWK (JSON Web Key), JWE (JSON Web Encryption), JWS (JSON Web Signature), and JWT (JSON Web Token).
Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm via the verify function. An attacker can impersonate any user, escalate privileges, and gain unauthorized access by crafting a JWT token with the header parameter alg set to none, which causes the verification process to return true without performing any cryptographic checks.