Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability exists in the fast-jwt library that could allow tokens to be misidentified during verification. This may result in valid tokens incorrectly returning claims from other tokens, leading to users being misidentified. The issue impacts versions prior to 6.2.0 and is addressed in version 6.2.0.
- Misidentified tokens can impersonate other users.
- Affects secure authentication and user access.
- Confirm relevance and exposure in your applications.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this by sending a specially crafted token to an application using a vulnerable version of the fast-jwt library. If the application has a custom cache key builder that doesn't create unique keys for different tokens, this could lead to a cache collision. This may cause the application to incorrectly verify a token, allowing an attacker to impersonate another user by presenting a valid token that returns claims from a different, valid token.
- No authentication is required.
- Triggered by sending a token to an application.
- Risk of user impersonation and data exposure.
Live Threat
Current exploitation, exposure, and threat context
A flaw in how custom cache keys are built in fast-jwt could lead to cache collisions. When supported, this could cause the system to misidentify tokens, potentially serving incorrect user data or claims from one valid token to another.
- User session data could be at risk.
- Incorrect tokens may be validated.
- Users could be misidentified.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners and platform teams are likely responsible for addressing this vulnerability, as it affects a library integrated into custom code. The first practical step is to identify all instances of the affected library, confirm if they are used in business-critical or externally reachable components, and then determine the accountable development team. Once identified, a plan for remediation, potentially involving vendor coordination or temporary risk reduction, should be developed based on the assessed risk.
- Application owners should own the issue.
- Verify token verification logic and reachability.
- Plan remediation based on identified risk.
