AIKIDO-2026-584205

jose is vulnerable to Improper Authentication

Improper Authentication Pre-CVE Published Today

Low Risk

This Affects:

jose

4.14.0 - 6.2.4

Fixed in 6.2.5

Are you affected? Scan for Free

TL;DR

The JWT Claims Set validation used by jwtVerify and jwtDecrypt forces the issuer, subject, audience, and maxTokenAge claims to be present when the matching option is defined, but gates the actual value comparison on option truthiness. When a consuming application supplies a falsy validation option such as an empty string issuer, subject, or audience, or a maxTokenAge of 0, the claim is required to exist but its value is never compared, so any iss, sub, aud, or issuance age is accepted. Tokens that should fail the configured claim checks therefore pass validation. The fix compares the claim values whenever the option is defined rather than only when it is truthy.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application passes a falsy issuer, subject, or audience value or a maxTokenAge of 0 to the JWT verification options (for example an unset or empty configuration value threaded straight into the options). The token's signature is still verified, so exploitation requires a validly signed token whose claim values differ from what the falsy option was intended to enforce.