{"id":"CVE-2026-34240","aliases":["EUVD-2026-17498","GHSA-vm9r-h74p-hg97"],"status":"published","title":"jose vulnerable to untrusted JWK header key acceptance during signature verification","description":"JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. Applications using affected versions for token verification are impacted. This issue has been patched in version 0.3.5+1. A workaround for this issue involves rejecting tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00135,"percentile":0.03002,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-03-31T15:44:23Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Pub","package":"jose","fixed_in":["0.3.5+1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Pub","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.5"},{"fixed":"0.3.5+1"}]}]},{"source":"osv","ecosystem":"Pub","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5+1"}]}],"versions":["0.1.0","0.1.0+1","0.1.0+2","0.1.1","0.1.2","0.1.2+1","0.2.0","0.2.1","0.2.1+1","0.2.2","0.3.0","0.3.0-nullsafety.1","0.3.0-nullsafety.2","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5"]}],"products":[{"vendor":"appsup-dart","product":"jose"}],"references":[{"url":"https://github.com/appsup-dart/jose/security/advisories/GHSA-vm9r-h74p-hg97","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/appsup-dart/jose/commit/b07799aac1f56a9a21483feac026272aab30cc5d","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34240","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vm9r-h74p-hg97"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34240.json","tags":["advisory"]},{"url":"https://github.com/appsup-dart/jose","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34240","title":"jose vulnerable to untrusted JWK header key acceptance during signature verification","description":"JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. Applications using affected versions for token verification are impacted. This issue has been patched in version 0.3.5+1. A workaround for this issue involves rejecting tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store.","status":"published","published":"2026-03-31T15:44:23.578Z","modified":"2026-04-01T14:03:14.969Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-17498","description":"JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. Applications using affected versions for token verification are impacted. This issue has been patched in version 0.3.5+1. A workaround for this issue involves rejecting tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store.","status":"published","published":"2026-03-31T15:44:23Z","modified":"2026-04-01T14:03:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:24.493801Z"}],"ghsa":[{"id":"GHSA-vm9r-h74p-hg97","title":"jose vulnerable to untrusted JWK header key acceptance during signature verification","description":"### Impact\n\nA vulnerability in `jose` versions up to and including `0.3.5` could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (`jwk`).  \n\nThe vulnerability exists because key selection could treat header-provided `jwk` as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key.  \n\nApplications using affected versions for token verification are impacted.\n\n### Patches\n\nUpgrade to `0.3.5+1` or later.\n\n### Workarounds\n\nReject tokens where header `jwk` is present unless that `jwk` matches a key already present in the application's trusted key store.\n\n### Resources\n\nFix commit: [fix: improved key resolution in JsonWebKeyStore](https://github.com/appsup-dart/jose/commit/b07799aac1f56a9a21483feac026272aab30cc5d)","status":"published","published":"2026-03-31T23:09:16Z","modified":"2026-04-02T15:45:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:39:47.945242Z"}],"nvd":[{"id":"CVE-2026-34240","description":"JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. Applications using affected versions for token verification are impacted. This issue has been patched in version 0.3.5+1. A workaround for this issue involves rejecting tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store.","status":"published","published":"2026-03-31T16:16:33.09Z","modified":"2026-07-24T20:10:00.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-34240","title":"jose vulnerable to untrusted JWK header key acceptance during signature verification","description":"JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. Applications using affected versions for token verification are impacted. This issue has been patched in version 0.3.5+1. A workaround for this issue involves rejecting tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store.","status":"published","published":"2026-03-31T15:44:23.578Z","modified":"2026-10-28T02:31:13.429975996Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-vm9r-h74p-hg97","title":"jose vulnerable to untrusted JWK header key acceptance during signature verification","description":"### Impact\n\nA vulnerability in `jose` versions up to and including `0.3.5` could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (`jwk`).  \n\nThe vulnerability exists because key selection could treat header-provided `jwk` as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key.  \n\nApplications using affected versions for token verification are impacted.\n\n### Patches\n\nUpgrade to `0.3.5+1` or later.\n\n### Workarounds\n\nReject tokens where header `jwk` is present unless that `jwk` matches a key already present in the application's trusted key store.\n\n### Resources\n\nFix commit: [fix: improved key resolution in JsonWebKeyStore](https://github.com/appsup-dart/jose/commit/b07799aac1f56a9a21483feac026272aab30cc5d)","status":"published","published":"2026-03-31T23:09:16Z","modified":"2026-03-31T23:26:27.178816Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}