AIKIDO-2026-176390
nimble_zta is vulnerable to Improper Verification of Cryptographic Signature
92
Critical Risk
This Affects:
nimble_ztaTL;DR
The nimble_zta Cloudflare authentication strategy accepts Zero Trust JWTs without checking whether JOSE.JWT.verify/2 reports the signature as valid. A crafted service token with the expected issuer and required claims is authenticated even when its cryptographic signature fails verification. Applications that enable the Cloudflare strategy can be impersonated by any party able to submit such a token. The fix checks the verification boolean before authenticating the JWT.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the Cloudflare authentication strategy.
Background info
nimble_zta is vulnerable to Improper Verification of Cryptographic Signature in versions 0.1.2 - 0.1.2.
How to fix this
Upgrade the nimble_zta library to the patch version.
Links
Fix Commits
github.com/dashbitco/nimble_zta/commit/6458fd18a5ba41166d4973214c519e98fe05b72dgithub.com/dashbitco/nimble_zta/commit/bc004b70985ae5763901baab3a4e204047899768
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.