JSON Web Tokens not properly verified

Vulnerability

The common package before commit 3b96cb0 did not properly verify the signature of JSON Web Tokens (JWTs). The validateToken method in ValidationUtil.java used Jwts.parser().parse() or Jwts.parser().parseJws() instead of Jwts.parser().parseClaimsJws(), which does not validate the token's signature [2][3][4]. This affects all versions prior to the fix. The code path is reachable by any service using the common library to authenticate users via JWTs.

Exploitation

An attacker with network access to a service that uses the vulnerable library can forge a valid JWT by crafting arbitrary claims and signing it with any key (or omitting the signature entirely). The attacker then presents this forged token to the service. Because the validateToken method does not verify the signature, the token is accepted as legitimate [2]. No prior authentication or special privileges are required.

Impact

Successful exploitation allows an attacker to bypass authentication entirely. The attacker can impersonate any user or role by embedding arbitrary claims (e.g., sub, roles) in the forged JWT. This can lead to unauthorized access to protected resources, data disclosure, or privilege escalation, depending on how the application uses JWT claims [2].

Mitigation

The vulnerability is patched in commit 3b96cb0 and later commits 12197a7 and a59ad46 on the master branch [1][2][3][4]. The fix replaces the insecure parse or parseJws call with parseClaimsJws, which verifies the JWT signature. As a workaround, developers can manually use Jwts.parser().setSigningKey(publicKey).parseClaimsJws(token) instead of parse in their own code [2]. No KEV listing is mentioned in the available references.