AIKIDO-2026-427357
jwt-simple is vulnerable to Authentication Bypass
53
CVE Score
Medium
Authentication Bypass
TL;DR
The library converts a JSON NumericDate to an unsigned timestamp with a Rust as cast, so a negative value such as -1 wraps to a value near u64::MAX. Under default options the exp claim is then read as an expiration far in the future, so an already expired token passes the expiration check. A token minted by a compromised, misconfigured, or independently authorized issuer can carry a negative exp and be accepted long after it should have expired. The fix rejects negative signed timestamps during deserialization.
How do I fix this?
Upgrade the jwt-simple library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you verify JWT tokens that can be minted by an external, compromised, or misconfigured issuer able to set negative time claims.
Package
Versions
0.0.1 - 0.12.17
Fixed in 0.13.0Background info
jwt-simple is vulnerable to Authentication Bypass in versions 0.0.1 - 0.12.17.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.