CVE-2025-59936

Published Sep 27, 2025

Last updated 12 days ago

CVSS critical 9.4
Jwt

Overview

Description
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss (issuer) claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an unexpected issuer to be reused, resulting in a bypass of issuer validation. This design flaw enables a potential attack where a malicious actor crafts a pair of JWTs, the first one ensuring that a chosen public key is fetched and stored in the shared JWKS cache, and the second one leveraging that cached key to pass signature validation for a targeted iss value. The vulnerability will work only if the iss validation is done after the use of get-jwks for keys retrieval. This issue has been patched in version 11.0.2.
Source
security-advisories@github.com
NVD status
Deferred

Risk scores

CVSS 3.0

Type
Secondary
Base score
9.4
Impact score
5.5
Exploitability score
3.9
Vector string
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Severity
CRITICAL

Weaknesses

security-advisories@github.com
CWE-116

Social media

Hype score
Not currently trending

  1. 🚨 Critical JWKS cache‑poisoning & issuer‑bypass in get-jwks — CVE-2025-59936. Update to the latest version NOW. Enforce strict iss/aud checks, reduce JWKS cache TTL, whitelist JWKS endpoints, and rotate keys if needed. More: https://t.co/X5XDn4hpsU

    @vulert_official

    3 Oct 2025

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 CVE-2025-59936: get-jwks poisoned JWKS cache all... Cache poisoning in get-jwks exposes critical JWT validation flaw - attackers can bypass issuer validation by pre-cachin... https://t.co/OsNH8MfI2i #netsec #vulnerability #CVE #sysadmin #zeroday

    @0dayPublishing

    28 Sept 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. [CVE-2025-59936: CRITICAL] Vulnerability in get-jwks pre-11.0.2 enables cache poisoning, bypassing issuer validation. Upgrade to version 11.0.2 to patch the flaw in JWKS key-fetching mechanism.#cve,CVE-2025-59936,#cybersecurity https://t.co/UzMJ2kvuCz https://t.co/x4YaDzhWrg

    @CveFindCom

    27 Sept 2025

    69 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.•CVE-2026-102265
  2. PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.•CVE-2026-102268
  3. A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to the exposed REST API port. A successful exploit could allow the attacker to read and modify ISE configuration and identity data with administrative privileges.•CVE-2026-76423
  4. Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.•CVE-2026-90945
  5. Adobe Commerce and Magento Incorrect Authorization Vulnerability •CVE-2026-71362

References

Sources include official advisories and independent security research.