5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25537

CVE-2026-25537: jsonwebtoken has Type Confusion that leads to potential authorization bypass

jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks the claim as “FailedToParse”. Crucially, the validation logic treats this “FailedToParse” state identically to “NotPresent”. This means that if a check is enabled (like: validate_nbf = true), but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim, treating it as if it were not there. This allows attackers to bypass critical time-based security restrictions (like “Not Before” checks) and commit potential authentication and authorization bypasses. This issue has been patched in version 10.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25537

CVE-2026-25537:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jsonwebtoken	rust	< 10.3.0	10.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a type confusion issue in the jsonwebtoken library for Rust. When validating JWT claims like nbf (not before) or exp (expiration time), the library's validate function did not correctly handle cases where the claim was provided in an incorrect format (e.g., a String instead of a Number).

The internal TryParse enum would represent this as FailedToParse. However, the validation logic only checked for the Parsed state and silently ignored FailedToParse and NotPresent states. This meant that if validate_nbf or validate_exp was enabled, but the claim was not in the required_spec_claims list, an attacker could provide a malformed claim (e.g., {"nbf": "99999999999"}) to bypass the time-based validation.

The fix, introduced in commit abbc3076742c4161347bc6b8bf4aa5eb86e1dc01, adds explicit checks in the jsonwebtoken::validation::validate function to return an InvalidClaimFormat error if validate_nbf or validate_exp is enabled and the corresponding claim failed to parse.

The vulnerable function is therefore jsonwebtoken::validation::validate, as it contained the flawed logic that skipped validation for malformed claims. An attacker exploiting this would cause this function to execute and incorrectly approve a token.

Vulnerable functions

jsonwebtoken::validation::validate

src/validation.rs

The `validate` function was vulnerable because it did not properly handle type confusion for time-based claims like `nbf` and `exp`. If a claim was provided as a string instead of a number, it would be marked internally as `TryParse::FailedToParse`. The validation logic would then silently ignore this state, bypassing the check entirely unless the claim was also in the `required_spec_claims` list. This allowed an attacker to bypass time-based security restrictions. The patch adds explicit checks to return an error for such malformed claims.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.