CVE-2026-34240
jose vulnerable to untrusted JWK header key acceptance during signature verification
Description
JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. Applications using affected versions for token verification are impacted. This issue has been patched in version 0.3.5+1. A workaround for this issue involves rejecting tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store.
INFO
Published Date :
March 31, 2026, 4:16 p.m.
Last Modified :
July 24, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update JOSE library to version 0.3.5+1.
- Reject tokens with header jwk not in trusted store.
- Ensure JWK is from a trusted key store.
Public PoC/Exploit Available at Github
CVE-2026-34240 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-34240.
| URL | Resource |
|---|---|
| https://github.com/appsup-dart/jose/commit/b07799aac1f56a9a21483feac026272aab30cc5d | Patch |
| https://github.com/appsup-dart/jose/security/advisories/GHSA-vm9r-h74p-hg97 | Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-34240 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-34240
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
example application to test and show case cicd security aspects
Kotlin Swift Objective-C Dart HTML
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-34240 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-34240 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 24, 2026
Action Type Old Value New Value Added Translation Title: jose de appsup-dart, Description: JOSE es una biblioteca de Javascript Object Signing and Encryption (JOSE). Antes de la versión 0.3.5+1, una vulnerabilidad en jose podría permitir a un atacante remoto no autenticado falsificar tokens JWS/JWT válidos utilizando una clave incrustada en el encabezado JOSE (jwk). La vulnerabilidad existe porque la selección de claves podría tratar el jwk proporcionado en el encabezado como un candidato de verificación incluso cuando esa clave no estaba presente en el almacén de claves de confianza. Dado que los encabezados JOSE son entrada no confiable, un atacante podría explotar esto creando una carga útil de token, incrustando una clave pública controlada por el atacante en el encabezado y firmando con la clave privada correspondiente. Las aplicaciones que utilizan versiones afectadas para la verificación de tokens se ven afectadas. Este problema ha sido parcheado en la versión 0.3.5+1. Una solución alternativa para este problema implica rechazar los tokens donde el jwk del encabezado está presente a menos que ese jwk coincida con una clave ya presente en el almacén de claves de confianza de la aplicación. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'appsup-dart', 'product': 'jose', 'versions': [{'status': 'affected', 'version': '< 0.3.5+1'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-34240', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-04-01T14:02:31.709988Z'} -
Initial Analysis by [email protected]
Apr. 06, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:appsup-dart:jose:*:*:*:*:*:*:*:* versions up to (excluding) 0.3.5+1 Added Reference Type GitHub, Inc.: https://github.com/appsup-dart/jose/commit/b07799aac1f56a9a21483feac026272aab30cc5d Types: Patch Added Reference Type GitHub, Inc.: https://github.com/appsup-dart/jose/security/advisories/GHSA-vm9r-h74p-hg97 Types: Vendor Advisory -
New CVE Received by [email protected]
Mar. 31, 2026
Action Type Old Value New Value Added Description JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. Applications using affected versions for token verification are impacted. This issue has been patched in version 0.3.5+1. A workaround for this issue involves rejecting tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Added CWE CWE-347 Added Reference https://github.com/appsup-dart/jose/commit/b07799aac1f56a9a21483feac026272aab30cc5d Added Reference https://github.com/appsup-dart/jose/security/advisories/GHSA-vm9r-h74p-hg97