AIKIDO-2026-51663
jwt-simple is vulnerable to Improper Authentication
53
CVE Score
Medium
Improper Authentication
TL;DR
The VerificationOptions::max_validity age check is nested inside the branch that reads the optional iat claim, so it is silently skipped when a token omits iat. An application that configures a maximum token lifetime to limit replay or issuer abuse accepts a token of arbitrary age as long as it carries no issuance time. This affects JWT and CWT verification whenever max_validity is set, and JWE decryption when claim options carrying max_validity are supplied. The fix makes max_validity require iat and rejects tokens that omit it.
How do I fix this?
Upgrade the jwt-simple library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you configure max_validity while accepting tokens that can omit the iat claim.
Package
Versions
0.0.1 - 0.12.17
Fixed in 0.13.0Background info
jwt-simple is vulnerable to Improper Authentication in versions 0.0.1 - 0.12.17.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.