Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-34240— jose vulnerable to untrusted JWK header key acceptance during signature verification

Quick assessment

Affected
appsup-dart jose
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

jose是Filip Skokan个人开发者的用于 JSON 对象签名和加密的 JavaScript 模块。 JOSE 0.3.5+1之前版本存在数据伪造问题漏洞，该漏洞源于密钥选择可能将JOSE标头中嵌入的jwk视为验证候选，可能导致伪造有效的JWS或JWT令牌。

CVSS 7.5 · High EPSS 0.19% · P8
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-34240

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
jose vulnerable to untrusted JWK header key acceptance during signature verification
Source: CVE Program / CVE List V5
Vulnerability Description
JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. Applications using affected versions for token verification are impacted. This issue has been patched in version 0.3.5+1. A workaround for this issue involves rejecting tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
jose 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
jose是Filip Skokan个人开发者的用于 JSON 对象签名和加密的 JavaScript 模块。 JOSE 0.3.5+1之前版本存在数据伪造问题漏洞，该漏洞源于密钥选择可能将JOSE标头中嵌入的jwk视为验证候选，可能导致伪造有效的JWS或JWT令牌。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
appsup-dart jose < 0.3.5+1 -

II. Public POCs for CVE-2026-34240

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-34240

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-34240 (1)

Vendor Advisories for CVE-2026-34240 (1)

IV. Related Vulnerabilities

Same product: jose
Same weakness: CWE-347

V. Comments for CVE-2026-34240

No comments yet

Leave a comment