Which versions of ueberauth Guardian are affected by CVE-2026-55735?

ueberauth Guardian, the authentication library used in Elixir web applications, contains a session termination vulnerability that allows attackers to forcibly log out any active user without…. A patch is available.

How to fix or mitigate CVE-2026-55735?

Within 24 hours, audit all Elixir applications to identify which systems use ueberauth Guardian and confirm whether versions 1.0.0-2.4.0 are in production. Within 7 days, validate Guardian 2.4.1 or later in staging environments to ensure compatibility with your session management, then deploy to non-production systems. Within 30 days, complete rollout of Guardian 2.4.1+ to all production environments and verify the fix through application logs confirming JWT signature verification is now enforced in revoke operations.

ueberauth Guardian CVE-2026-55735

Q: What is the CVSS score of CVE-2026-55735?

CVE-2026-55735 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51914 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-01 EEF

Denial Of Service Microsoft Jwt Attack Guardian Ueberauth

8.2

CVSS 4.0 · Vendor: EEF

Severity by source

Vendor (EEF) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-accessible with no required privileges or interaction; sole impact is availability (forced session revocation); AC:L because the forging mechanism is technically trivial once claim values are known.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 01, 2026 - 19:21 vuln.today

Analysis Generated

Aug 01, 2026 - 19:21 vuln.today

CVE Published

Aug 01, 2026 - 18:46 cve.org

HIGH 8.2

DescriptionCVE.org

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token.

Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature.

An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.

This issue affects guardian: from 1.0.0 before 2.4.1.

AnalysisAI

Session revocation denial-of-service in ueberauth Guardian (Elixir) allows an unauthenticated network attacker to forcibly terminate any user's active session by submitting a cryptographically forged JWT to a logout endpoint. Guardian.revoke/3 extracted claims via peek/1 - which only base64-decodes the JWT without verifying the signature - and passed those unverified claims directly to the token store's revocation callback, enabling a forged token carrying a victim's jti or sub values to evict a legitimate session. The vulnerability spans all production releases 1.0.0 through pre-2.4.1; no public exploit or CISA KEV listing exists at time of analysis, but the attack requires only knowledge of a victim's identifying JWT claims.

Technical ContextAI

The root cause is CWE-347 (Improper Verification of Cryptographic Signature) in the Guardian Elixir JWT authentication library (cpe:2.3:a:ueberauth:guardian). Guardian.revoke/3 in lib/guardian.ex used peek/1 to extract claims from the caller-supplied token; peek/1 merely base64-decodes the JWT header and payload without performing any HMAC or asymmetric signature verification. The sibling state-mutating operations refresh/2 and exchange/4 both correctly call decode_and_verify before acting on claims, making revoke/3 the sole code path that operated on unverified claim data. In deployments using a persistent, claim-keyed token store such as GuardianDb, passing unverified claims to the revoke callback triggers a real database write - deleting the victim's session record - because the store keys revocation state on jti or sub values that the attacker fully controls in the forged JWT payload.

RemediationAI

Upgrade to Guardian 2.4.1 or later; this version replaces the peek/1 call in revoke/3 with decode_token/3, which verifies the token signature before any revocation callback is invoked. Claim validation (including expiry) is intentionally still skipped in the patched code, preserving the ability to revoke already-expired tokens. The fix is confirmed in commit 2bd7a8c29770d423d855c0a4965caa6c3e486901 (https://github.com/ueberauth/guardian/commit/2bd7a8c29770d423d855c0a4965caa6c3e486901) and documented in GHSA-7975-hp3r-5qhv. If an immediate upgrade is not feasible, add an explicit signature verification step in your application's logout controller: call Guardian.decode_and_verify/3 on the incoming token before forwarding it to Guardian.revoke/3, and reject any token that fails verification. The trade-off of this workaround is that legitimately expired tokens will also fail decode_and_verify and will need a separate code path to remain revocable; applications that do not need to explicitly revoke expired tokens can accept this trade-off without impact.