Listen to this Post
How the mentioned CVE works:
The vulnerability is an authentication bypass in the `jose-swift` library. It resides in the `verify()` method within the `JWS+Verify.swift` file. When a JSON Web Token (JWT) header specifies the signing algorithm as “alg”: “none”, the verification function immediately returns true. This occurs at lines 34-37 where a guard statement checks if the algorithm is `.none` and, if true, returns without performing any cryptographic signature validation. The `SigningAlgorithm` enum explicitly includes `case none = “none”` as a valid option. Consequently, an attacker can forge a token by Base64URL-encoding a header with `alg:”none”` and any malicious payload, such as one granting admin privileges. The final forged token concatenates the encoded header, payload, and a trailing dot for an empty signature (e.g., header.payload.). All verification methods, including instance, static, and high-level JWT APIs, are affected. When the vulnerable application receives this token, the `verify(key:)` method skips all signature checks against the legitimate secret key. This allows the forged token to pass as valid, enabling impersonation and privilege escalation without knowing the signing key.
DailyCVE Form:
Platform: jose-swift library
Version: Vulnerable versions
Vulnerability: Authentication Bypass
Severity: Critical
Date: 2026-01-10
Prediction: Patch expected Q1-2026
What Undercode Say:
Analytics:
`echo -n ‘{“alg”:”none”,”typ”:”JWT”}’ | base64 | tr ‘/+’ ‘_-‘ | tr -d ‘=’`
`echo -n ‘{“sub”:”attacker”,”admin”:true}’ | base64 | tr ‘/+’ ‘_-‘ | tr -d ‘=’`
curl -H "Authorization: Bearer eyJhbGciOiJub25l...In0." https://vulnerable.target/api/admin`“admin”:true`).
<h2 style="color: blue;">How Exploit:</h2>
<h2 style="color: blue;">1. Craft a malicious JWT with `{"alg":"none"}` header.</h2>
2. Encode header and a payload with escalated claims (e.g.,
3. Combine them as `[bash].[bash].` (note the trailing dot).
4. Submit the token to the target’s authentication endpoint.
Protection from this CVE:
1. Update library immediately.
2. Reject `alg:”none”` tokens.
3. Use explicit algorithm whitelists.
Impact:
1. Complete authentication bypass.
2. Arbitrary user impersonation.
3. Full privilege escalation.
4. Unauthorized resource access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
