Ash Authentication JWT Revocation Bypass via Unverified Claims Vulnerability

Vulnerability Overview Vulnerability Name: Revocation records are built from unverified JWT claims, allowing token holders to bypass revocation Severity: Medium (CVSS 3.1 score: 5.9 / 10) CVE ID: CVE-2023-XXXX (as displayed on the page; refer to the screenshot for the specific ID) Core Issue: reads the Bearer token from the header, extracts the claim, and uses it directly to locate the resource without verifying the JWT signature. An attacker can craft a forged token with the same and an expired to overwrite the genuine revocation record, thereby nullifying the revocation. Scope of Impact Affected Versions: - (4.x series) - (5.0 pre-release versions) Affected Files: - - ( ) - ( ) - Impact: Attackers can use forged/unsigned tokens to prevent the target user’s session from being revoked, causing the session termination mechanism to fail. Remediation 1. Set to : Forces token verification before revocation, reducing the impact. 2. Rotate signing keys: When key compromise is suspected, rotating the signing key invalidates all existing tokens, regardless of whether the revocation record has been tampered with. 3. Code-level Fixes: - : Verify the token signature before executing the revocation. - : passes unverified claims to ; it must ensure that the claim is type-checked and signature-verified. - correctly implements signature verification, but some call paths do not utilize it. POC / Exploitation Code The screenshot does not contain a complete POC code block, but the key exploitation logic is as follows: Key Code Path:

Goal Reached Thanks to every supporter — we hit 100%!

Ash Authentication JWT Revocation Bypass via Unverified Claims Vulnerability

More from this source