CVE-2026-107722

Summary

The flaw allows an attacker to misclassify RSA public keys as HMAC secrets, enabling them to sign JWTs with the public key, leading to authentication or authorization bypass.

Exploitability

Exploitation requires knowledge of the public key bytes and the ability to manipulate the key content. The attack is moderately hard to exploit due to the need for precise key manipulation.

Blast radius

If exploited, this could lead to unauthorized access or privilege escalation, impacting the security of the application and potentially the entire system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to fast-jwt version 6.3.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.