Critical · published September 27, 2025
🚨 A cache poisoning vulnerability in get-jwks before version 11.0.2 could allow attackers to bypass issuer validation with crafted JWTs! 🔥 Think of it like a restaurant where someone sneaks in a fake reservation. They get the table by using a name that looks good on paper, but they never should have been allowed in. In this case, cached keys from an unexpected issuer gain access where they shouldn’t! If exploited, this vulnerability allows a malicious actor to trick the system into accepting false claims by manipulating the cached keys. This means unauthorized access and potential data breaches could ensue, putting your sensitive information at risk. It’s absolutely devastating when you realize someone else is dining at your table, using your name!
Think of it like a restaurant where someone sneaks in a fake reservation. They get the table by using a name that looks good on paper, but they never should have been allowed in. In this case, cached keys from an unexpected issuer gain access where they shouldn’t! This vulnerability lies in the JWKS key-fetching mechanism, where the issuer claim is validated only after retrieving keys from the cache. This design flaw allows attackers to fetch and store a malicious key in the shared cache, bypassing proper issuer checks upon retrieval.
If exploited, this vulnerability allows a malicious actor to trick the system into accepting false claims by manipulating the cached keys. This means unauthorized access and potential data breaches could ensue, putting your sensitive information at risk. It’s absolutely devastating when you realize someone else is dining at your table, using your name! To protect against this vulnerability, immediately upgrade to version 11.0.2 or higher. Review your caching mechanisms to ensure issuer claims are validated before fetching keys, and implement robust checks in your JWT handling process. Don't wait; act now! You've got this! By following these steps, you can secure your systems and keep those sneaky attackers at bay! 🛡️