Jwt Attack CVE-2026-33487

Requires target application to use goxmldsig library versions prior to 1.6.0 for XML Digital Signature validation. Additionally requires either Go compiler version before 1.22 OR go.mod file specifying an older Go language version (e.g., go 1.21 or earlier), as Go 1.22+ changed loop variable capture semantics to fix this class of bugs. The vulnerable code path is triggered when processing XML documents containing SignedInfo blocks with multiple Reference elements sharing the same URI or ID attribute. Exploitation is limited to contexts where the application accepts externally-supplied signed XML documents, such as SAML authentication endpoints, XML document verification services, or federated identity providers. Attack vector is network-based (AV:N) with no authentication required (PR:N), but practical exploitation requires knowledge of the target's Go version and goxmldsig library version, plus understanding of XML signature structure to craft payloads that trigger the multi-reference scenario. Applications using Go 1.22+ with updated go.mod are inherently immune regardless of goxmldsig version.

CVSS 7.5 (High) indicates network-accessible, low-complexity exploitation requiring no authentication or user interaction, with high integrity impact. However, real-world risk requires nuanced assessment across multiple signals. EPSS score of 0.02% (5th percentile) suggests extremely low observed exploitation probability in the wild, indicating this is not currently a widespread attacker target. The vulnerability requires specific conditions: applications must use goxmldsig versions before 1.6.0 AND either run on Go versions before 1.22 or have go.mod configured for older Go versions. Attack complexity is genuinely low once these conditions are met, as crafting malicious XML signatures is straightforward for attackers familiar with XMLDSig structure. The high integrity impact (I:H) is accurate: successful exploitation enables signature forgery, potentially allowing authentication bypass in SAML implementations or document tampering in signed XML workflows. No public exploit code or active exploitation confirmed at time of analysis. SSVC assessment suggests deferred priority: not automatable at scale (requires knowledge of target's Go version and goxmldsig usage), technical impact limited to efficient manipulation of authentication/authorization decisions. Primary risk is to organizations using older Go toolchains with SAML or XML signing implementations-these should prioritize patching. Organizations on Go 1.22+ with updated go.mod files are inherently protected even without library upgrade.

An attacker crafts a malicious SAML assertion containing multiple Reference elements in the SignedInfo block, where the first reference points to a legitimate assertion with restricted permissions and the second reference points to an attacker-controlled assertion granting administrative access. Due to the loop variable capture bug, the validation logic processes all references but ultimately validates against only the last reference in the list. The attacker's manipulated assertion passes signature validation despite the signature actually covering different content, enabling authentication bypass and privilege escalation in federated SSO environments.