AIKIDO-2026-530808
guardian is vulnerable to Improper Verification of Cryptographic Signature
82
High Risk
This Affects:
guardianTL;DR
Guardian.revoke/3 in lib/guardian.ex acts on JWT claims obtained through peek, which performs no signature verification. A caller-supplied token is decoded without checking its signature, so forged claim values reach the token module's revoke and on_revoke callbacks. Before the fix, someone who knows a target's jti and sub claim values can forge a token and force revocation of that session without possessing the signing secret. The fix decodes and verifies the token signature before invoking the revoke callbacks while still allowing already-expired tokens to be revoked.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application routes a caller-supplied token into Guardian.revoke/3 with a token module that mutates session state keyed by token claims.
Background info
guardian is vulnerable to Improper Verification of Cryptographic Signature in versions 1.0.0 - 2.4.0.
How to fix this
Upgrade the guardian library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant