Skip to content
OpenAdvisories

Package · Debian

libjwt3

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-44699

    LibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC

    LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length…

    benmcollins libjwt libjwt libjwt3 Debian Ubuntu