Skip to content
OpenAdvisories
Critical USN-9075-1 1 CVE

libjwt vulnerability

Published Nov 12, 2026 · Updated Nov 13, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libjwt did not use a constant-time comparison when
verifying HMAC signatures. A remote attacker could possibly use this issue
to forge signatures through a timing side-channel attack and bypass
authentication.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libjwt 1.9.0-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS libjwt 1.10.2-1ubuntu0.20.04.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS libjwt 1.10.2-1ubuntu0.22.04.1~esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2024-25189

    libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authen…

    libjwt libjwt Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2024-25189