EUVD-2026-74618
GHSA-vqxm-cgmv-2pcr
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Forged ciphertext arrives over the network in typical deployments (JWT, protocol messages), so AV:N; no special conditions beyond submitting forged ciphertext.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false, but the destination buffer already holds the full plaintext.
AnalysisAI
Authenticated decryption in mirage-crypto before 2.2.0 for OCaml violates the security invariant of AEAD schemes by writing decrypted plaintext into the caller-supplied output buffer before the authentication tag is verified. When a forged tag is detected, AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into return false, but the destination buffer already contains the full unverified plaintext. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability affects any OCaml application using mirage-crypto before 2.2.0 that calls `AES.GCM.authenticate_decrypt_into` or `Chacha20.authenticate_decrypt_into` and either (a) reads from the output buffer without first checking the boolean return value for authentication success, or (b) is subject to compiler or runtime optimizations that expose the buffer contents before the return value is evaluated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:L/AC:L/PR:N/UI:N/I:H) rates this at 6.2, but the local attack vector assignment is questionable - in the dominant real-world use pattern, forged ciphertext arrives over the network (JWE/JWT tokens, protocol messages), making AV:N more accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to mirage-crypto 2.2.0 or later, which corrects the ordering to verify the authentication tag before writing any plaintext to the output buffer. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Share
External POC / Exploit Code
Leaving vuln.today