AIKIDO-2025-10384

TL;DR

Affected versions of this package are vulnerable to improper validation in the WorkloadAPI.ValidateJWTSVID endpoint, where the expiration claim in JWT-SVIDs was not validated as required by the SPIFFE specification. By default, SPIRE does not issue JWT-SVIDs without an expiration claim, limiting impact; however, an attacker could exploit this by federating with a misconfigured or non-compliant trust domain to bypass expiration checks, potentially using indefinitely valid tokens for unauthorized access.