CVE-2026-55735 ueberauth CVE debrief

Who should care

Users of ueberauth guardian versions from 1.0.0 before 2.4.1 should verify and apply remediation to prevent potential unauthenticated session revocation denial of service. This includes verifying affected product deployments, reviewing official advisories, and planning vendor-supported updates or mitigations. Compensating controls, such as monitoring and exception tracking, should be implemented for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retest remediated assets, and close the item only after evidence is documented. Conduct inventory checks for affected guardian versions and track exceptions, retest remediated assets, and close the item only after evidence is documented. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra.

Technical summary

The Guardian.revoke/3 function in lib/guardian.ex does not verify the signature of the supplied token before acting on its claims, allowing an unauthenticated attacker to forge a token and revoke a victim's session. This issue affects guardian versions from 1.0.0 before 2.4.1. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3. When the token module mutates state keyed by the claims, the victim's legitimate session is evicted.

Defensive priority

High priority due to potential for unauthenticated session revocation denial of service.

Recommended defensive actions

• Verify and apply vendor remediation for guardian versions prior to 2.4.1
• Implement compensating controls, such as monitoring and exception tracking
• Conduct inventory checks for affected guardian versions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited; primary official records indicate improper verification of cryptographic signatures in ueberauth guardian, allowing unauthenticated session revocation. Further verification tasks are recommended.

Official resources