AIKIDO-2026-427357
jwt-simple is vulnerable to Authentication Bypass
53
Medium Risk
This Affects:
jwt-simpleTL;DR
The library converts a JSON NumericDate to an unsigned timestamp with a Rust as cast, so a negative value such as -1 wraps to a value near u64::MAX. Under default options the exp claim is then read as an expiration far in the future, so an already expired token passes the expiration check. A token minted by a compromised, misconfigured, or independently authorized issuer can carry a negative exp and be accepted long after it should have expired. The fix rejects negative signed timestamps during deserialization.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you verify JWT tokens that can be minted by an external, compromised, or misconfigured issuer able to set negative time claims.
Background info
jwt-simple is vulnerable to Authentication Bypass in versions 0.0.1 - 0.12.17.
How to fix this
Upgrade the jwt-simple library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant