Skip to content
OpenAdvisories

Package · Ubuntu

libjwt

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-44699

    LibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC

    LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length…

    benmcollins libjwt libjwt libjwt3 Debian Ubuntu
  • Critical 9.8
    CVE-2024-25189

    libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authen…

    libjwt libjwt Debian Ubuntu