CVE-2026-34240 Details
Description
JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. Applications using affected versions for token verification are impacted. This issue has been patched in version 0.3.5+1. A workaround for this issue involves rejecting tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store.
A vulnerability exists in the JOSE library, specifically in versions through 0.3.5, allowing unauthenticated remote attackers to forge valid JWS/JWT tokens. This is achieved by embedding a public key in the JOSE header, which can be used to sign a token payload. The issue arises because the key selection process may incorrectly accept header-provided keys as verification candidates, even if they are not included in the trusted key store. Since JOSE headers are considered untrusted input, this vulnerability can be exploited by creating a token with an attacker-controlled key, leading to unauthorized token verification in applications that use the affected JOSE version.
Users are advised to upgrade to JOSE version 0.3.5+1 or later. As a workaround, tokens containing a header 'jwk' should be rejected unless the 'jwk' matches a key already stored in the application's trusted key store.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appsup-dart jose | < 0.3.5\+1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |