AIKIDO-2025-10329

TL;DR

Affected versions of this package are vulnerable to JWT (JSON Web Token) revocation bypass due to improper handling of non-canonical Base64 encoding in token validation. The revocation mechanism relies on exact string matching in a cache. However, without proper steganography validation, decoding methods may accept multiple encoding iterations of the same data. An attacker can exploit this by altering a revoked JWT's signature in a way that changes its encoding representation while preserving its decoded value, effectively bypassing revocation checks while still passing signature verification.