PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34240 appsup-dart CVE debrief

A high-severity vulnerability was discovered in the JOSE library, which could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because key selection could treat header-provided jwk as a verification candidate even when that key was not present in the trusted key store. This issue has been patched in version 0.3.5+1. Organizations should review their use of the JOSE library and take steps to mitigate this vulnerability.

Vendor
appsup-dart
Product
jose
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Organizations using the JOSE library for token verification should be aware of this vulnerability and take immediate action to patch or mitigate it. This includes reviewing current deployments, updating to version 0.3.5+1 or later, and ensuring that token verification processes are secure and not using vulnerable versions of the library.

Technical summary

The JOSE library, prior to version 0.3.5+1, is vulnerable to token forgery due to improper handling of header-provided jwk keys. An attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key. This issue allows for the creation of forged valid JWS/JWT tokens, potentially impacting applications using affected versions for token verification.

Defensive priority

High

Recommended defensive actions

  • Upgrade to version 0.3.5+1 or later
  • Reject tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store
  • Review and update token verification processes
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-03-31T16:16:33.090Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. Evidence is limited to public sources and may not reflect the full scope or impact of this vulnerability. Defenders should verify affected systems and review official advisories for specific guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T16:16:33.090Z and has not been modified since then. The NVD entry is currently Analyzed.