AIKIDO-2025-10595

TL;DR

Affected versions of this package are vulnerable to improper serialization of token headers due to allowing unprotected headers to overwrite integrity-protected headers. An attacker with access to the JWS JSON object can exploit this by injecting malicious values into unprotected headers (e.g., modifying key to point to a malicious key, or altering exp to extend token validity), bypassing signature validation for critical parameters and potentially leading to authentication bypass or privilege escalation.