Elixir Guardian CVE-2026-55738: Unverified Token Claims Leading to Unauthorized Session Revocation

Vulnerability Overview Title: Revoke processes unverified token claims CVE ID: CVE-2026-55738 Severity: High (8.2 / 10) CVSS v4 Base Metrics: Attack Vector: Network Attack Complexity: Low Attack Requirements: Present Privileges Required: User Interaction User Interaction: None System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: High Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Description: In the function of the Elixir Guardian library, JWT claims are not verified. An unauthenticated attacker can guess or obtain the victim's JWT claims, forge a JWT carrying these claims, sign it with an arbitrary key, and submit it to any endpoint that passes the caller-provided token to (standard logout/session revocation pattern). When the configured token module modifies session state based on these claims, the victim's legitimate session will be evicted, resulting in an unauthorized denial-of-service via session revocation. Details: In , the function decodes the provided token using , while is explicitly documented as performing verification-free decoding (only based on the decoded JWT header and payload). The unverified claims decoded from are forwarded directly to the callback of the configured token module and passed down to the implementer's callback, which is a state-mutating call. Other operations within the same module, such as and , both invoke , which first checks the signature before performing any operations on the claims. is the only state-mutating path where caller-provided claims reach the callback before signature verification, and the signature is never checked. With no signature check and no fallback to , the responsibility lies clearly with each token module. Typical token modules revoke tokens by removing the from the token or blacklist (e.g., session state storage); thus, they act maliciously on any received . Using the default callback, session state is not changed, and the issue is not exploitable. The fix involves running (or verification without expiration check, so that expired tokens remain revocable) before invoking the token module's callback, and only passing verified claims. Affected Versions Affected Versions: >= 1.0.0 and < 2.4.1 Fixed Version: 2.4.1 Remediation Fix Method: Run (or verification without expiration check) before invoking the token module's callback, and pass only verified claims. POC Code 1. The target application exposes a logout/session revocation operation that passes the caller-provided token to , using a token module keyed by to delete session state. 2. A normal login via generates a properly signed token and a whitelisted session (active session count = 1). 3. The attacker knows the victim's and claim values (but not the signing key), forges a JWT carrying these claims and signs it with HS512 and a garbage key. 4. returns on the forged token, confirming the signature is indeed invalid. 5. The attacker submits the same forged token to , bypassing verification, and passes the forged and to , deleting the victim's session (active session count drops to 0). Impact Unauthenticated attackers who know or can guess the target's and claim values can force user logout (from the whitelist storage) or revoke the target session without possessing the signing key. Any application routing to and using a state-mutating token module keyed by token claims is affected. References Introduced Commit: d652271 Patch Commit: 25d7afc

Goal Reached Thanks to every supporter — we hit 100%!

Elixir Guardian CVE-2026-55738: Unverified Token Claims Leading to Unauthorized Session Revocation

More from this source