CVE-2026-91187 (GCVE-0-2026-91187)

Vulnerability from cvelistv5 – Published: 2026-09-24 13:20 – Updated: 2026-09-24 14:47
VLAI
Title
Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy
Summary
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity. This issue affects nimble_zta: from 0.1.2 before 0.1.3.
Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 14:43 UTC
CWE
  • CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
Vendor Product Version CPE status
dashbit nimble_zta Affected: 0.1.2 , < 0.1.3 (semver)
    cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*
Create a notification for this product.
dashbit nimble_zta Affected: bc004b70985ae5763901baab3a4e204047899768 , < 6458fd18a5ba41166d4973214c519e98fe05b72d (git)
    cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Kazlu José Valim / Dashbit Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91187",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:43:06.738544Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T14:47:30.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NimbleZTA.Cloudflare\u0027"
          ],
          "packageName": "nimble_zta",
          "packageURL": "pkg:hex/nimble_zta",
          "product": "nimble_zta",
          "programFiles": [
            "lib/nimble_zta/cloudflare.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:authenticate/3"
            },
            {
              "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:verify_token/2"
            }
          ],
          "repo": "https://github.com/dashbitco/nimble_zta",
          "vendor": "dashbit",
          "versions": [
            {
              "lessThan": "0.1.3",
              "status": "affected",
              "version": "0.1.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NimbleZTA.Cloudflare\u0027"
          ],
          "packageName": "dashbitco/nimble_zta",
          "packageURL": "pkg:github/dashbitco/nimble_zta",
          "product": "nimble_zta",
          "programFiles": [
            "lib/nimble_zta/cloudflare.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:authenticate/3"
            },
            {
              "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:verify_token/2"
            }
          ],
          "repo": "https://github.com/dashbitco/nimble_zta",
          "vendor": "dashbit",
          "versions": [
            {
              "lessThan": "6458fd18a5ba41166d4973214c519e98fe05b72d",
              "status": "affected",
              "version": "bc004b70985ae5763901baab3a4e204047899768",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must add \u003ccode\u003eNimbleZTA.Cloudflare\u003c/code\u003e to its supervision tree and authenticate requests through it.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application must add `NimbleZTA.Cloudflare` to its supervision tree and authenticate requests through it."
            }
          ],
          "value": "The application must add NimbleZTA.Cloudflare to its supervision tree and authenticate requests through it."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.1.3",
                  "versionStartIncluding": "0.1.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kazlu"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jos\u00e9 Valim / Dashbit"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-09-24T09:09:36.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003everify_token/2\u003c/code\u003e in \u003ccode\u003elib/nimble_zta/cloudflare.ex\u003c/code\u003e matches the result of \u003ccode\u003eJOSE.JWT.verify/2\u003c/code\u003e against \u003ccode\u003e{_, token, _s}\u003c/code\u003e, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the \u003ccode\u003ecf-access-jwt-assertion\u003c/code\u003e header, carrying the expected \u003ccode\u003eiss\u003c/code\u003e claim and the seven service token claims. \u003ccode\u003everify_iss/2\u003c/code\u003e reads the \u003ccode\u003eiss\u003c/code\u003e claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.\u003c/p\u003e\n\u003cp\u003eThis issue affects nimble_zta: from 0.1.2 before 0.1.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.\n\n`verify_token/2` in `lib/nimble_zta/cloudflare.ex` matches the result of `JOSE.JWT.verify/2` against `{_, token, _s}`, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the `cf-access-jwt-assertion` header, carrying the expected `iss` claim and the seven service token claims. `verify_iss/2` reads the `iss` claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.\n\nThis issue affects nimble_zta: from 0.1.2 before 0.1.3."
            }
          ],
          "value": "Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.\n\nverify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.\n\nThis issue affects nimble_zta: from 0.1.2 before 0.1.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe attacker authenticates as an arbitrary Cloudflare service token without holding the Cloudflare signing key. The application receives the \u003ccode\u003eclient_id\u003c/code\u003e and the claims of the forged token as the authenticated identity, so the attacker gets the access that the application grants to that service token.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "The attacker authenticates as an arbitrary Cloudflare service token without holding the Cloudflare signing key. The application receives the `client_id` and the claims of the forged token as the authenticated identity, so the attacker gets the access that the application grants to that service token."
                }
              ],
              "value": "The attacker authenticates as an arbitrary Cloudflare service token without holding the Cloudflare signing key. The application receives the client_id and the claims of the forged token as the authenticated identity, so the attacker gets the access that the application grants to that service token."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T13:20:52.974Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "GitHub Advisory",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/dashbitco/nimble_zta/security/advisories/GHSA-rj24-g8cc-g7g2"
        },
        {
          "name": "EEF CNA record for CVE-2026-91187",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-91187.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-91187",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-91187"
        },
        {
          "name": "Introducing commit bc004b7 in dashbitco/nimble_zta",
          "tags": [
            "related"
          ],
          "url": "https://github.com/dashbitco/nimble_zta/commit/bc004b70985ae5763901baab3a4e204047899768"
        },
        {
          "name": "Fix commit 6458fd1 in dashbitco/nimble_zta",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/dashbitco/nimble_zta/commit/6458fd18a5ba41166d4973214c519e98fe05b72d"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDisable the Cloudflare authentication strategy.\u003c/p\u003e\n\u003cp\u003eTo keep the user identity strategy available, reject the service token requests yourself. Examine each request before you call \u003ccode\u003eNimbleZTA.Cloudflare.authenticate/3\u003c/code\u003e, and reject it if its JWT carries the \u003ccode\u003ecommon_name\u003c/code\u003e claim and the \u003ccode\u003etype\u003c/code\u003e claim.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Disable the Cloudflare authentication strategy.\n\nTo keep the user identity strategy available, reject the service token requests yourself. Examine each request before you call `NimbleZTA.Cloudflare.authenticate/3`, and reject it if its JWT carries the `common_name` claim and the `type` claim."
            }
          ],
          "value": "Disable the Cloudflare authentication strategy.\n\nTo keep the user identity strategy available, reject the service token requests yourself. Examine each request before you call NimbleZTA.Cloudflare.authenticate/3, and reject it if its JWT carries the common_name claim and the type claim."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eBuild a JWT payload that carries the \u003ccode\u003eaud\u003c/code\u003e, \u003ccode\u003ecommon_name\u003c/code\u003e, \u003ccode\u003eexp\u003c/code\u003e, \u003ccode\u003eiat\u003c/code\u003e, \u003ccode\u003eiss\u003c/code\u003e, \u003ccode\u003esub\u003c/code\u003e and \u003ccode\u003etype\u003c/code\u003e claims. Use the \u003ccode\u003eiss\u003c/code\u003e the application expects, set \u003ccode\u003eexp\u003c/code\u003e to a future timestamp, and set \u003ccode\u003ecommon_name\u003c/code\u003e to the service token to impersonate.\u003c/li\u003e\n\u003cli\u003eAppend any signature segment. The segment must be present, because \u003ccode\u003eJOSE.JWT.verify/2\u003c/code\u003e needs three segments to parse the token. The signature does not need to verify against the Cloudflare keys.\u003c/li\u003e\n\u003cli\u003eSend a request to the application with the forged JWT in the \u003ccode\u003ecf-access-jwt-assertion\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eNimbleZTA.Cloudflare.authenticate/3\u003c/code\u003e returns the claims of the forged token as the authenticated identity, with the \u003ccode\u003estrategy\u003c/code\u003e field set to \u003ccode\u003eservice_token\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. Build a JWT payload that carries the `aud`, `common_name`, `exp`, `iat`, `iss`, `sub` and `type` claims. Use the `iss` the application expects, set `exp` to a future timestamp, and set `common_name` to the service token to impersonate.\n2. Append any signature segment. The segment must be present, because `JOSE.JWT.verify/2` needs three segments to parse the token. The signature does not need to verify against the Cloudflare keys.\n3. Send a request to the application with the forged JWT in the `cf-access-jwt-assertion` header.\n4. `NimbleZTA.Cloudflare.authenticate/3` returns the claims of the forged token as the authenticated identity, with the `strategy` field set to `service_token`."
            }
          ],
          "value": "* Build a JWT payload that carries the aud, common_name, exp, iat, iss, sub and type claims. Use the iss the application expects, set exp to a future timestamp, and set common_name to the service token to impersonate.\n* Append any signature segment. The segment must be present, because JOSE.JWT.verify/2 needs three segments to parse the token. The signature does not need to verify against the Cloudflare keys.\n* Send a request to the application with the forged JWT in the cf-access-jwt-assertion header.\n* NimbleZTA.Cloudflare.authenticate/3 returns the claims of the forged token as the authenticated identity, with the strategy field set to service_token."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-91187",
    "datePublished": "2026-09-24T13:20:52.974Z",
    "dateReserved": "2026-09-15T15:30:01.892Z",
    "dateUpdated": "2026-09-24T14:47:30.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.NimbleZTA.Cloudflare\u0027"
                ],
                "packageName": "nimble_zta",
                "packageURL": "pkg:hex/nimble_zta",
                "product": "nimble_zta",
                "programFiles": [
                  "lib/nimble_zta/cloudflare.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:authenticate/3"
                  },
                  {
                    "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:verify_token/2"
                  }
                ],
                "repo": "https://github.com/dashbitco/nimble_zta",
                "vendor": "dashbit",
                "versions": [
                  {
                    "lessThan": "0.1.3",
                    "status": "affected",
                    "version": "0.1.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.NimbleZTA.Cloudflare\u0027"
                ],
                "packageName": "dashbitco/nimble_zta",
                "packageURL": "pkg:github/dashbitco/nimble_zta",
                "product": "nimble_zta",
                "programFiles": [
                  "lib/nimble_zta/cloudflare.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:authenticate/3"
                  },
                  {
                    "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:verify_token/2"
                  }
                ],
                "repo": "https://github.com/dashbitco/nimble_zta",
                "vendor": "dashbit",
                "versions": [
                  {
                    "lessThan": "6458fd18a5ba41166d4973214c519e98fe05b72d",
                    "status": "affected",
                    "version": "bc004b70985ae5763901baab3a4e204047899768",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.\n\nverify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.\n\nThis issue affects nimble_zta: from 0.1.2 before 0.1.3."
          }
        ],
        "id": "CVE-2026-91187",
        "lastModified": "2026-09-24T19:39:45.600",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-91187",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:43:06.738544Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-24T14:18:18.667",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-91187.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/dashbitco/nimble_zta/commit/6458fd18a5ba41166d4973214c519e98fe05b72d"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/dashbitco/nimble_zta/commit/bc004b70985ae5763901baab3a4e204047899768"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/dashbitco/nimble_zta/security/advisories/GHSA-rj24-g8cc-g7g2"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-91187"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-347"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-91187",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-24T14:43:06.738544Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-24T14:43:10.349Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.NimbleZTA.Cloudflare\u0027"
              ],
              "packageName": "nimble_zta",
              "packageURL": "pkg:hex/nimble_zta",
              "product": "nimble_zta",
              "programFiles": [
                "lib/nimble_zta/cloudflare.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:authenticate/3"
                },
                {
                  "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:verify_token/2"
                }
              ],
              "repo": "https://github.com/dashbitco/nimble_zta",
              "vendor": "dashbit",
              "versions": [
                {
                  "lessThan": "0.1.3",
                  "status": "affected",
                  "version": "0.1.2",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.NimbleZTA.Cloudflare\u0027"
              ],
              "packageName": "dashbitco/nimble_zta",
              "packageURL": "pkg:github/dashbitco/nimble_zta",
              "product": "nimble_zta",
              "programFiles": [
                "lib/nimble_zta/cloudflare.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:authenticate/3"
                },
                {
                  "name": "\u0027Elixir.NimbleZTA.Cloudflare\u0027:verify_token/2"
                }
              ],
              "repo": "https://github.com/dashbitco/nimble_zta",
              "vendor": "dashbit",
              "versions": [
                {
                  "lessThan": "6458fd18a5ba41166d4973214c519e98fe05b72d",
                  "status": "affected",
                  "version": "bc004b70985ae5763901baab3a4e204047899768",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe application must add \u003ccode\u003eNimbleZTA.Cloudflare\u003c/code\u003e to its supervision tree and authenticate requests through it.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "The application must add `NimbleZTA.Cloudflare` to its supervision tree and authenticate requests through it."
                }
              ],
              "value": "The application must add NimbleZTA.Cloudflare to its supervision tree and authenticate requests through it."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "0.1.3",
                      "versionStartIncluding": "0.1.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Kazlu"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Jos\u00e9 Valim / Dashbit"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "dateAssigned": "2026-09-24T09:09:36.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eImproper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003everify_token/2\u003c/code\u003e in \u003ccode\u003elib/nimble_zta/cloudflare.ex\u003c/code\u003e matches the result of \u003ccode\u003eJOSE.JWT.verify/2\u003c/code\u003e against \u003ccode\u003e{_, token, _s}\u003c/code\u003e, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the \u003ccode\u003ecf-access-jwt-assertion\u003c/code\u003e header, carrying the expected \u003ccode\u003eiss\u003c/code\u003e claim and the seven service token claims. \u003ccode\u003everify_iss/2\u003c/code\u003e reads the \u003ccode\u003eiss\u003c/code\u003e claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.\u003c/p\u003e\n\u003cp\u003eThis issue affects nimble_zta: from 0.1.2 before 0.1.3.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.\n\n`verify_token/2` in `lib/nimble_zta/cloudflare.ex` matches the result of `JOSE.JWT.verify/2` against `{_, token, _s}`, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the `cf-access-jwt-assertion` header, carrying the expected `iss` claim and the seven service token claims. `verify_iss/2` reads the `iss` claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.\n\nThis issue affects nimble_zta: from 0.1.2 before 0.1.3."
                }
              ],
              "value": "Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.\n\nverify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.\n\nThis issue affects nimble_zta: from 0.1.2 before 0.1.3."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-475",
              "descriptions": [
                {
                  "lang": "en",
                  "supportingMedia": [
                    {
                      "base64": false,
                      "type": "text/html",
                      "value": "\u003cp\u003eThe attacker authenticates as an arbitrary Cloudflare service token without holding the Cloudflare signing key. The application receives the \u003ccode\u003eclient_id\u003c/code\u003e and the claims of the forged token as the authenticated identity, so the attacker gets the access that the application grants to that service token.\u003c/p\u003e"
                    },
                    {
                      "base64": false,
                      "type": "text/markdown",
                      "value": "The attacker authenticates as an arbitrary Cloudflare service token without holding the Cloudflare signing key. The application receives the `client_id` and the claims of the forged token as the authenticated identity, so the attacker gets the access that the application grants to that service token."
                    }
                  ],
                  "value": "The attacker authenticates as an arbitrary Cloudflare service token without holding the Cloudflare signing key. The application receives the client_id and the claims of the forged token as the authenticated identity, so the attacker gets the access that the application grants to that service token."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-347",
                  "description": "CWE-347 Improper Verification of Cryptographic Signature",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-24T13:20:52.974Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "name": "GitHub Advisory",
              "tags": [
                "related",
                "vendor-advisory"
              ],
              "url": "https://github.com/dashbitco/nimble_zta/security/advisories/GHSA-rj24-g8cc-g7g2"
            },
            {
              "name": "EEF CNA record for CVE-2026-91187",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-91187.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-91187",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-91187"
            },
            {
              "name": "Introducing commit bc004b7 in dashbitco/nimble_zta",
              "tags": [
                "related"
              ],
              "url": "https://github.com/dashbitco/nimble_zta/commit/bc004b70985ae5763901baab3a4e204047899768"
            },
            {
              "name": "Fix commit 6458fd1 in dashbitco/nimble_zta",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/dashbitco/nimble_zta/commit/6458fd18a5ba41166d4973214c519e98fe05b72d"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eDisable the Cloudflare authentication strategy.\u003c/p\u003e\n\u003cp\u003eTo keep the user identity strategy available, reject the service token requests yourself. Examine each request before you call \u003ccode\u003eNimbleZTA.Cloudflare.authenticate/3\u003c/code\u003e, and reject it if its JWT carries the \u003ccode\u003ecommon_name\u003c/code\u003e claim and the \u003ccode\u003etype\u003c/code\u003e claim.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Disable the Cloudflare authentication strategy.\n\nTo keep the user identity strategy available, reject the service token requests yourself. Examine each request before you call `NimbleZTA.Cloudflare.authenticate/3`, and reject it if its JWT carries the `common_name` claim and the `type` claim."
                }
              ],
              "value": "Disable the Cloudflare authentication strategy.\n\nTo keep the user identity strategy available, reject the service token requests yourself. Examine each request before you call NimbleZTA.Cloudflare.authenticate/3, and reject it if its JWT carries the common_name claim and the type claim."
            }
          ],
          "x_proofOfConcept": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003col\u003e\n\u003cli\u003eBuild a JWT payload that carries the \u003ccode\u003eaud\u003c/code\u003e, \u003ccode\u003ecommon_name\u003c/code\u003e, \u003ccode\u003eexp\u003c/code\u003e, \u003ccode\u003eiat\u003c/code\u003e, \u003ccode\u003eiss\u003c/code\u003e, \u003ccode\u003esub\u003c/code\u003e and \u003ccode\u003etype\u003c/code\u003e claims. Use the \u003ccode\u003eiss\u003c/code\u003e the application expects, set \u003ccode\u003eexp\u003c/code\u003e to a future timestamp, and set \u003ccode\u003ecommon_name\u003c/code\u003e to the service token to impersonate.\u003c/li\u003e\n\u003cli\u003eAppend any signature segment. The segment must be present, because \u003ccode\u003eJOSE.JWT.verify/2\u003c/code\u003e needs three segments to parse the token. The signature does not need to verify against the Cloudflare keys.\u003c/li\u003e\n\u003cli\u003eSend a request to the application with the forged JWT in the \u003ccode\u003ecf-access-jwt-assertion\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eNimbleZTA.Cloudflare.authenticate/3\u003c/code\u003e returns the claims of the forged token as the authenticated identity, with the \u003ccode\u003estrategy\u003c/code\u003e field set to \u003ccode\u003eservice_token\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "1. Build a JWT payload that carries the `aud`, `common_name`, `exp`, `iat`, `iss`, `sub` and `type` claims. Use the `iss` the application expects, set `exp` to a future timestamp, and set `common_name` to the service token to impersonate.\n2. Append any signature segment. The segment must be present, because `JOSE.JWT.verify/2` needs three segments to parse the token. The signature does not need to verify against the Cloudflare keys.\n3. Send a request to the application with the forged JWT in the `cf-access-jwt-assertion` header.\n4. `NimbleZTA.Cloudflare.authenticate/3` returns the claims of the forged token as the authenticated identity, with the `strategy` field set to `service_token`."
                }
              ],
              "value": "* Build a JWT payload that carries the aud, common_name, exp, iat, iss, sub and type claims. Use the iss the application expects, set exp to a future timestamp, and set common_name to the service token to impersonate.\n* Append any signature segment. The segment must be present, because JOSE.JWT.verify/2 needs three segments to parse the token. The signature does not need to verify against the Cloudflare keys.\n* Send a request to the application with the forged JWT in the cf-access-jwt-assertion header.\n* NimbleZTA.Cloudflare.authenticate/3 returns the claims of the forged token as the authenticated identity, with the strategy field set to service_token."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-91187",
        "datePublished": "2026-09-24T13:20:52.974Z",
        "dateReserved": "2026-09-15T15:30:01.892Z",
        "dateUpdated": "2026-09-24T14:47:30.520Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.