AIKIDO-2026-959477
jwcrypto is vulnerable to Improper Verification of Cryptographic Signature
31
CVE Score
Low
Improper Verification of Cryptographic Signature
TL;DR
jwcrypto verifies a JSON Web Signature against a JWKSet by looking up the signer's key using the kid header parameter. When a JWS carries multiple signatures, the verification path reads kid from the overall jose_header instead of each signature's own checked headers, so a signature that declares kid only in an unprotected header, or a non-first signature in a multi-signature JWS, can resolve against the wrong key from the set. This key-confusion is limited to specific and uncommon multi-signature or unprotected-header kid usage with a JWKSet. The fix reads kid from each signature's own checked headers before performing the key lookup.
How do I fix this?
Upgrade the jwcrypto library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you verify multi-signature JWS objects, or JWS signatures using an unprotected-header kid value, against a JWKSet.
Package
Versions
1.3 - 1.5.9
Fixed in 1.6.0Background info
jwcrypto is vulnerable to Improper Verification of Cryptographic Signature in versions 1.3 - 1.5.9.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.