EUVD-2026-26062
GHSA-qpv2-rwc8-c993
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-reachable, low-complexity, unauthenticated JWT forgery (AV:N/AC:L/PR:N) exposes sensitive host/network data (C:H); some host-scoped write is possible (I:L) but description centers on disclosure (A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information
AnalysisAI
Authentication bypass in Netmaker (Gravitl) versions prior to 1.5.0 lets remote unauthenticated attackers forge host JWTs because VerifyHostToken in logic/jwts.go never validates the token signature. An attacker can sign a token with any arbitrary key to impersonate any host and reach host-scoped API endpoints, exposing sensitive network topology and peer information. SSVC lists a public proof-of-concept and rates the flaw automatable; EPSS is low (0.04%) and it is not on CISA KEV, so publicly available exploit code exists but no active exploitation is confirmed.
Technical ContextAI
Netmaker is an open-source WireGuard-based platform for building and managing overlay/mesh virtual networks, where a central server issues JWT bearer tokens to enrolled hosts and nodes that then call authenticated management APIs. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): the VerifyHostToken function parses and trusts the JWT claims (host ID) without cryptographically verifying the signature against the server's signing key. The commit diff (5309aa70) shows the legacy Authorize() middleware - which called VerifyHostToken as a host shortcut - being replaced by a rewritten AuthorizeHost() path, and it hardens host-scoped routes such as deleteHost, deleteNode, getNode, pull, signalpeer, hostUpdateFallback, and peer_info. The single affected CPE is cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: upgrade Netmaker to 1.5.0 or later, which replaces the vulnerable host-authorization path so host tokens are properly verified (see the fix commit https://github.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481a79b and advisory https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass). If immediate upgrade is not possible, do not expose the Netmaker server API to untrusted networks: restrict access to the management API (and the host endpoints /api/hosts/*, /api/v1/host*, /api/nodes/*) to trusted management IPs via firewall or reverse-proxy allowlisting, and place the server behind a VPN or mTLS-terminating gateway - the trade-off is that legitimate remote hosts must connect from known networks or through the gateway, which can complicate roaming clients. Rotating the JWT signing secret does not mitigate this issue because the signature is not checked at all, so signing-key rotation alone provides no protection. Monitor host API access logs for tokens claiming host IDs from unexpected source addresses as a detective control.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today