jose vulnerable to untrusted JWK header key acceptance during signature verification

Impact

A vulnerability in jose versions up to and including 0.3.5 could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk).

The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key.

Applications using affected versions for token verification are impacted.

Patches

Upgrade to 0.3.5+1 or later.

Workarounds

Reject tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store.

Resources

Fix commit: fix: improved key resolution in JsonWebKeyStore