{"id":"CVE-2026-25554","title":"OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass","summary":"OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL databa…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cvssSource":"cna","cwe":["CWE-89"],"vendor":"OpenSIPS","product":"OpenSIPS","affected":["OpenSIPS >= 3.1 < 3.6.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-03-04T16:43:08.070958Z"},"published":"2026-02-25","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:01:27.090Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-25554","references":[{"url":"https://opensips.org/pub/opensips/3.6.4/ChangeLog"},{"url":"https://github.com/OpenSIPS/opensips/pull/3807"},{"url":"https://github.com/OpenSIPS/opensips/commit/3822d33c1c6b25832fdd88da1d23eed74be55b05"},{"url":"https://opensips.org/"},{"url":"https://www.vulncheck.com/advisories/opensips-auth-jwt-sql-injection-enables-jwt-authentication-bypass"}],"tags":["cve.org"],"epss":0.00364,"epssPercentile":0.30498,"ingestedAt":"2026-11-08T14:51:22.471Z","slug":"CVE-2026-25554","body":"## Overview\n\nOpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities.\n\n## Affected\n\n- `OpenSIPS >= 3.1 < 3.6.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}