CVE-2025-59685

Vulnerability

Kazaar versions 1.25.12 and below accept JSON Web Tokens (JWT) with the algorithm field set to 'none' [2]. This violates the JWT specification, which requires that the 'none' algorithm only be used with transport layer security. The application does not properly verify the token signature, allowing an attacker to forge valid tokens.

Exploitation

An attacker with a valid JWT from any user account can decode the token, change the algorithm to 'none', and modify the payload as desired [2]. The modified token will be accepted by the server for any endpoint, bypassing authentication entirely. No prior network position is required beyond normal HTTP access to the application.

Impact

Successful exploitation grants the attacker unauthorized access to all endpoints with the privileges of the impersonated user. This could lead to data exposure, manipulation, and privilege escalation depending on the user role.

Mitigation

The issue is patched in Kazaar version 1.25.12? Actually the advisory says versions below 1.25.12 are affected. The fix likely requires strict validation of the JWT algorithm. Users should upgrade to the latest version. [2]