SmallRye JWT EUVD-2026-81617

Exploitation requires the application to configure SmallRye JWT with the AWS_ALB key provider (AwsAlbKeyResolver) - a non-default setting specific to verifying tokens signed by AWS Application Load Balancers; installations not using this provider are unaffected. When enabled, no authentication or user interaction is needed because the malicious kid header is processed before JWT signature verification. The primary limiting factor is scope: the attacker can only reach paths on the same origin as the configured key endpoint (internal/non-public endpoints reachable from the server), and impact is limited to reading data (confidentiality only, no write or code execution).

This is a genuine but moderate-severity issue. The CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly captures an unauthenticated, network-reachable, low-complexity flaw with confidentiality-only impact - the attacker reads internal same-origin data but gains no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active exploitation; this is a real fix-it priority for affected deployments but not an emergency. A key nuance: the assigned weakness is CWE-22 (Path Traversal) and the only tag is 'Path Traversal,' yet the described behavior - forcing the server to issue GET requests to attacker-chosen paths - is fundamentally Server-Side Request Forgery (CWE-918). The traversal characters are merely the mechanism; the impact is SSRF. Exploitation is strongly gated by configuration: it only triggers when the AWS_ALB key provider is enabled, which is a non-default, AWS-ALB-specific deployment, sharply narrowing the real exposed population despite the unauthenticated network vector.

An application using SmallRye JWT with the AWS_ALB key provider receives an inbound JWT whose 'kid' header contains path-traversal or query-string characters. Before signature verification, the resolver concatenates that value into the key-fetch URL, causing the server to issue a GET to an internal/non-public path on the key endpoint's origin and return that internal content to the unauthenticated attacker. No public exploit code is identified at time of analysis, though the attack requires only a crafted JWT and low complexity.