CVE-2026-19194
- Source
- https://cve.org/CVERecord?id=CVE-2026-19194
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19194.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-19194
- Published
- 2026-11-13T21:17:56Z
- Modified
- 2026-11-14T10:45:38Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- CAP JWT claims validation bypass using non-canonical claim names
- Details
-
The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0.
- Database specific
{ "cna_assigner": "HashiCorp", "cwe_ids": [ "CWE-178" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19194.json" }- References
Affected packages
Git / github.com/hashicorp/cap
Affected ranges
- Type
- GIT
- Repo
- https://github.com/hashicorp/cap
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "0.14.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }