CVE-2026-91187 Details
Description
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity. This issue affects nimble_zta: from 0.1.2 before 0.1.3.
A vulnerability exists in Dashbit Nimble ZTA versions 0.1.2 prior to 0.1.3, allowing unauthenticated remote attackers to authenticate as arbitrary Cloudflare service tokens. This issue arises from improper verification of JSON Web Token (JWT) signatures in the Cloudflare authentication strategy. The vulnerability enables attackers to bypass signature validation and gain access to resources associated with the impersonated service token.
Users can upgrade to Dashbit Nimble ZTA version 0.1.3 or later, where this vulnerability is fixed. If an immediate upgrade is not possible, Cloudflare JWTs should be rejected unless the signature verification returns true. Alternatively, the Cloudflare authentication strategy can be disabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-91187.html | EEF | AdvisoryExploit |
| https://github.com/dashbitco/nimble_zta/commit/6458fd18a5ba41166d4973214c519e98fe05b72d | EEF | Source CodeVendor |
| https://github.com/dashbitco/nimble_zta/commit/bc004b70985ae5763901baab3a4e204047899768 | EEF | Source CodeVendor |
| https://github.com/dashbitco/nimble_zta/security/advisories/GHSA-rj24-g8cc-g7g2 | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-91187 | EEF | AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | EEF |
Affected Products
| Product | Versions |
|---|---|
| dashbit nimble_zta | >= 0.1.2, < 0.1.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | EEF |