CVE-2026-107724High· 7.4▾ MidnightPoC availablefast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetr…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Exploit / PoC code exists
0.2% → 0.3%
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
fast-jwt = 6.2.4Patched in:
fast-jwt 6.3.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107722Critical· 9.8fast-jwt provides fast JSON Web Token (JWT) implementation
CVE-2026-107723High· 8.1fast-jwt provides fast JSON Web Token (JWT) implementation
CVE-2026-107720High· 7.4fast-jwt provides fast JSON Web Token (JWT) implementation
CVE-2026-107721Medium· 5.9fast-jwt provides fast JSON Web Token (JWT) implementation
CVE-2026-107719Medium· 4.2fast-jwt provides fast JSON Web Token (JWT) implementation
CVE-2026-1529High· 8.1A flaw was found in Keycloak