{"metadata": {"vulnerability": "cve-2026-107720", "count": 12, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-10-08T17:21:52.975Z", "date_only": false, "value": "2026-10-08T17:21:52.975Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-107720", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-08T21:44:06.843Z", "date_only": false, "value": "2026-10-08T21:44:06.843Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-107720", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-08T21:44:06.843Z", "date_only": false, "value": "2026-10-08T21:44:06.843Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-107720", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-08T22:02:12Z", "date_only": false, "value": "2026-10-08T22:02:12Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8WPC-H4Q6-8FXV", "record": "GHSA-8WPC-H4Q6-8FXV", "field": "published"}, {"timestamp": "2026-10-08T22:02:12Z", "date_only": false, "value": "2026-10-08T22:02:12Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8WPC-H4Q6-8FXV", "record": "GHSA-8WPC-H4Q6-8FXV", "field": "modified"}, {"timestamp": "2026-10-08T22:17:28.090Z", "date_only": false, "value": "2026-10-08T22:17:28.090", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107720", "record": "FKIE_CVE-2026-107720", "field": "published"}, {"timestamp": "2026-10-09T11:30:30Z", "date_only": false, "value": "2026-10-09T11:30:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/bdd9ca77c66ecf18eb44553e670ffee0", "record": "CVE-2026-107720", "field": "creation_timestamp", "uuid": "a0b69da3-c325-4e49-a0dc-d2fa8e4dee89", "content": "# CVE-2026-107720: CVE-2026-107720: Signature Verification Bypass in NearForm fast-jwt\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107720\n\n## Summary\nCVE-2026-107720 is a critical signature verification bypass vulnerability in NearForm's fast-jwt Node.js library. Under specific configurations where the token verifier is initialized with a falsy cryptographic key (such as an empty string or null) and a non-empty algorithms allowlist, the library erroneously skips signature validation. This allows unauthenticated remote attackers to submit fabricated, unsigned JSON Web Tokens and bypass the authorization boundary of the application entirely.\n\n## TL;DR\nA flaw in fast-jwt prior to 6.3.1 allows attackers to forge JSON Web Tokens and bypass authorization checks entirely if the library is configured with a blank/null key and an explicit list of allowed algorithms.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-347 (Improper Verification of Cryptographic Signature)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.4 (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not listed\n- **Impact**: Complete authentication and authorization bypass\n\n## Affected Systems\n\n- All Node.js applications using NearForm fast-jwt versions prior to 6.3.1\n- **fast-jwt**: < 6.3.1 (Fixed in: `6.3.1`)\n\n## Mitigation\n\n- Upgrade the fast-jwt dependency to version 6.3.1 or higher immediately.\n- Implement robust environment variable validation to crash the application if cryptographic keys are resolved as empty or null.\n- Explicitly omit or restrict the use of the 'none' algorithm unless it is required by design.\n\n**Remediation Steps:**\n1. Locate the package.json file of the application and check the fast-jwt version.\n2. Execute the package manager update command: 'npm install fast-jwt@6.3.1' or equivalent.\n3. Audit the application bootstrap code to ensure that the secrets supplied to 'createVerifier' are verified as non-empty during initialization.\n4. Re-deploy the application and confirm through logging that no warning or key initialization errors are present.\n\n## References\n\n- [Official Security Advisory (GitHub)](https://github.com/nearform/fast-jwt/security/advisories/GHSA-8wpc-h4q6-8fxv)\n- [Official Fix Commit](https://github.com/nearform/fast-jwt/commit/e22a151e83bf6d5e54e281216982d204d5665534)\n- [NVD CVE Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-107720)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107720) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/bdd9ca77c66ecf18eb44553e670ffee0"}, {"timestamp": "2026-10-09T14:31:56.862Z", "date_only": false, "value": "2026-10-09T14:31:56.862139Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-107720", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-09T14:31:56.862Z", "date_only": false, "value": "2026-10-09T14:31:56.862139Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107720", "record": "FKIE_CVE-2026-107720", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-09T14:32:14.931Z", "date_only": false, "value": "2026-10-09T14:32:14.931Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-107720", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-09T14:32:14.931Z", "date_only": false, "value": "2026-10-09T14:32:14.931Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-107720", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-09T15:17:08.947Z", "date_only": false, "value": "2026-10-09T15:17:08.947", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107720", "record": "FKIE_CVE-2026-107720", "field": "lastModified"}]}