Jwt Attack
CVE-2025-43522
LOW
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Impact | The CVSS 3.3 score reflects a low-impact vulnerability: local attack vector (AV:L), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and confidentiality impact limited to low (C:L) with no integrity or availability impact. The EPSS score of 0.01% (first percentile) is exceptionally low, indicating minimal real-world exploitation probability despite technical feasibility. No KEV (CISA Known Exploited Vulnerabilities) status is indicated, meaning there is no confirmed active exploitation. The mismatch between a measurable CVSS score and near-zero EPSS suggests this is a privilege-escalation or multi-step attack requiring local access and low-privileged context - not a primary attack vector for most threat actors. This is a real but low-priority vulnerability suitable for standard patch cycles rather than emergency response. |
| Exploit ScenarioDerived | An unprivileged local user or installed application could craft a malicious app that exploits the code-signing validation weakness to bypass restrictions and access sensitive user data files or authentication tokens stored on the system. The attack requires the attacker to already have local code execution capability (explaining the low privilege requirement), making it a post-compromise lateral-movement or privilege-escalation technique rather than a direct user-facing attack vector. No public proof-of-concept has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Intel-based Mac computers running macOS Sequoia prior to 15.7.3 or macOS Tahoe prior to 26.2 are vulnerable to a cryptographic downgrade attack that allows unprivileged local applications to bypass code-signing restrictions and access sensitive user data. The vulnerability exploits inadequate validation of signed components, enabling information disclosure through JWT or similar signed-data attacks. Active exploitation has not been confirmed, and the extremely low EPSS score (0.01%) indicates minimal real-world exploitation risk despite the local attack vector.
RemediationAI
Vendor-released patch: Update to macOS Sequoia 15.7.3 or macOS Tahoe 26.2 or later. Users on Intel-based Mac computers should immediately apply the corresponding security update for their operating system version. Apple has addressed this issue by implementing additional code-signing restrictions to prevent downgrade attacks. Detailed patching instructions and compatibility information are available at https://support.apple.com/en-us/125886. Users unable to patch immediately should minimize the installation and execution of untrusted applications from non-official sources, as the vulnerability requires local code execution with low privileges to exploit.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability involves improper validation of code signatures on Intel-based macOS systems, specifically related to cryptographic signature verification mechanisms (CWE-347: Improper Verification of Cryptographic Signature). The issue allows a downgrade attack where an application can bypass or weaken code-signing protections that normally enforce code integrity. The 'JWT Attack' tag suggests the weakness may relate to how signed tokens or certificates are validated, potentially allowing an attacker to present older or weaker signature formats that are still accepted by the validation logic. The vulnerability is specific to Intel processors on macOS (cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*) and affects the operating system's core code-signing enforcement mechanisms.
Know when Jwt Attack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
DescriptionCVE.org
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to access user-sensitive data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated a
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
GitHub PoC
Exploit-DB