https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 23:52:39 +0000 https://vulnerability.circl.lu/sighting/e8c069fd-42e9-442b-98e6-8db5c9c5ac57/export {"uuid": "e8c069fd-42e9-442b-98e6-8db5c9c5ac57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107722", "type": "seen", "source": "https://gist.github.com/alon710/15273fb5d12305b113736e384312b6e1", "content": "# CVE-2026-107722: CVE-2026-107722: Algorithm Confusion via Non-Whitespace Prefix Bypass in fast-jwt\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107722\n\n## Summary\nA critical cryptographic vulnerability in fast-jwt versions 6.2.x prior to 6.3.0 allows unauthenticated remote attackers to execute an asymmetric-to-symmetric algorithm confusion attack due to incomplete validation of leading non-whitespace prefixes.\n\n## TL;DR\nIncomplete key sanitization in fast-jwt allows RSA-to-HMAC algorithm confusion, enabling complete authentication bypass.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-347\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **Impact**: Complete Authentication Bypass\n- **Exploit Status**: Proof-of-Concept (PoC) available in test suite\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-jwt Node.js library\n- **fast-jwt**: >= 6.2.0 < 6.3.0 (Fixed in: `6.3.0`)\n\n## Mitigation\n\n- Upgrade fast-jwt to 6.3.0 or higher\n- Configure an explicit algorithm allowlist in verifier options\n\n**Remediation Steps:**\n1. Verify the installed fast-jwt version in package.json\n2. Execute 'npm install fast-jwt@6.3.0' to update the dependency\n3. Audit JWT verifier configurations and enforce explicit algorithm parameters\n\n## References\n\n- [GitHub Security Advisory GHSA-ww5h-9m49-7xx4](https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4)\n- [GitHub Pull Request #632](https://github.com/nearform/fast-jwt/pull/632)\n- [Fix Commit d96bbc6](https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107722) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T12:30:30.000000Z"} {"uuid": "e8c069fd-42e9-442b-98e6-8db5c9c5ac57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107722", "type": "seen", "source": "https://gist.github.com/alon710/15273fb5d12305b113736e384312b6e1", "content": "# CVE-2026-107722: CVE-2026-107722: Algorithm Confusion via Non-Whitespace Prefix Bypass in fast-jwt\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107722\n\n## Summary\nA critical cryptographic vulnerability in fast-jwt versions 6.2.x prior to 6.3.0 allows unauthenticated remote attackers to execute an asymmetric-to-symmetric algorithm confusion attack due to incomplete validation of leading non-whitespace prefixes.\n\n## TL;DR\nIncomplete key sanitization in fast-jwt allows RSA-to-HMAC algorithm confusion, enabling complete authentication bypass.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-347\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **Impact**: Complete Authentication Bypass\n- **Exploit Status**: Proof-of-Concept (PoC) available in test suite\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-jwt Node.js library\n- **fast-jwt**: >= 6.2.0 < 6.3.0 (Fixed in: `6.3.0`)\n\n## Mitigation\n\n- Upgrade fast-jwt to 6.3.0 or higher\n- Configure an explicit algorithm allowlist in verifier options\n\n**Remediation Steps:**\n1. Verify the installed fast-jwt version in package.json\n2. Execute 'npm install fast-jwt@6.3.0' to update the dependency\n3. Audit JWT verifier configurations and enforce explicit algorithm parameters\n\n## References\n\n- [GitHub Security Advisory GHSA-ww5h-9m49-7xx4](https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4)\n- [GitHub Pull Request #632](https://github.com/nearform/fast-jwt/pull/632)\n- [Fix Commit d96bbc6](https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107722) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T12:30:30.000000Z"} https://vulnerability.circl.lu/sighting/e8c069fd-42e9-442b-98e6-8db5c9c5ac57/export Fri, 09 Oct 2026 12:30:30 +0000 https://vulnerability.circl.lu/sighting/99cc848a-10e8-45f3-ad8b-455e7e9fc212/export {"uuid": "99cc848a-10e8-45f3-ad8b-455e7e9fc212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107722", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxfondffii2x", "content": "\ud83d\udea8 CVE-2026-107722 \u2014 CVSS 9.8 CRITICAL\n\nfast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassif...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-107722\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T00:08:41.820507Z"} {"uuid": "99cc848a-10e8-45f3-ad8b-455e7e9fc212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107722", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxfondffii2x", "content": "\ud83d\udea8 CVE-2026-107722 \u2014 CVSS 9.8 CRITICAL\n\nfast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassif...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-107722\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T00:08:41.820507Z"} https://vulnerability.circl.lu/sighting/99cc848a-10e8-45f3-ad8b-455e7e9fc212/export Fri, 09 Oct 2026 00:08:41 +0000 https://vulnerability.circl.lu/sighting/ed6e0acd-4814-47b4-b622-72c2d5a34b53/export {"uuid": "ed6e0acd-4814-47b4-b622-72c2d5a34b53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107722", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxfkaqilrl2r", "content": "CVE-2026-107722 - fast-jwt\nThe fast-jwt library (versions 6.2.0 and later) still fails to strip certain non\u2011space characters before checking a public key format. As a result, an attacker who can add a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#fastjwt #nearform #npm #CVE #infosec", "creation_timestamp": "2026-10-08T22:50:04.491037Z"} {"uuid": "ed6e0acd-4814-47b4-b622-72c2d5a34b53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107722", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxfkaqilrl2r", "content": "CVE-2026-107722 - fast-jwt\nThe fast-jwt library (versions 6.2.0 and later) still fails to strip certain non\u2011space characters before checking a public key format. As a result, an attacker who can add a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#fastjwt #nearform #npm #CVE #infosec", "creation_timestamp": "2026-10-08T22:50:04.491037Z"} https://vulnerability.circl.lu/sighting/ed6e0acd-4814-47b4-b622-72c2d5a34b53/export Thu, 08 Oct 2026 22:50:04 +0000