AIKIDO-2026-11109
System.IdentityModel.Tokens.Jwt is vulnerable to Authentication Bypass
65
Medium Risk
This Affects:
System.IdentityModel.Tokens.JwtTL;DR
JwtSecurityTokenHandler resolves signing keys through a documented precedence chain when validating JWT signatures. Before the fix, a missing else allowed IssuerSigningKeyResolver to run after IssuerSigningKeyResolverUsingConfiguration, contrary to the documented contract and JsonWebTokenHandler behavior. Applications that configure both resolvers can validate signatures with keys from the less restrictive legacy resolver instead of configuration-derived keys. The fix adds else if so configuration-based resolution takes exclusive priority.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
System.IdentityModel.Tokens.Jwt is vulnerable to Authentication Bypass in versions 7.0.0 - 7.7.1.
How to fix this
Upgrade the System.IdentityModel.Tokens.Jwt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant