CVE-2026-44699

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44699
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44699.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44699
Aliases
  • GHSA-q843-6q5f-w55g
Downstream
Published
2026-05-15T16:08:34.405Z
Modified
2026-07-08T08:13:28.721963723Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
LibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC
Details

LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44699.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-327",
        "CWE-347"
    ]
}
References

Affected packages

Git / github.com/benmcollins/libjwt

Affected ranges

Type
GIT
Repo
https://github.com/benmcollins/libjwt
Events
Introduced
97bb1e5cdd0c47e3d60eb7c44c7214ff4ad7b4c4
Fixed
602118d99d46ca5df71bda60d3df642135417f29
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.3.3"
        }
    ]
}

Affected versions

v3.*
v3.0.0
v3.1.0
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.3.0
v3.3.1
v3.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44699.json"