AIKIDO-2026-51663
jwt-simple is vulnerable to Improper Authentication
53
Medium Risk
This Affects:
jwt-simpleTL;DR
The VerificationOptions::max_validity age check is nested inside the branch that reads the optional iat claim, so it is silently skipped when a token omits iat. An application that configures a maximum token lifetime to limit replay or issuer abuse accepts a token of arbitrary age as long as it carries no issuance time. This affects JWT and CWT verification whenever max_validity is set, and JWE decryption when claim options carrying max_validity are supplied. The fix makes max_validity require iat and rejects tokens that omit it.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you configure max_validity while accepting tokens that can omit the iat claim.
Background info
jwt-simple is vulnerable to Improper Authentication in versions 0.0.1 - 0.12.17.
How to fix this
Upgrade the jwt-simple library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant