EUVD-2026-85871Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote signature bypass yielding impersonation, so PR:N/AC:L; scope changes because the auth library grants access to a separate protected application (S:C), with high confidentiality and integrity and no availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
5DescriptionCVE.org
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.
verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.
This issue affects nimble_zta: from 0.1.2 before 0.1.3.
AnalysisAI
Improper JWT signature verification in Dashbit's nimble_zta (0.1.2 up to but not including 0.1.3) lets an unauthenticated remote attacker bypass authentication and impersonate an arbitrary Cloudflare service token in applications using the Cloudflare Zero Trust service-token strategy. Because verify_token/2 pattern-matches the {_, token, _s} tuple returned by JOSE.JWT.verify/2, the boolean signature-verification result is discarded and a forged JWT sent in the cf-access-jwt-assertion header is accepted as authenticated identity; the attacker only needs the expected iss claim plus the seven service-token claims (aud, common_name, exp, iat, iss, sub, type). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only against applications that use nimble_zta (0.1.2 up to but not including 0.1.3) with the Cloudflare Zero Trust authentication strategy, specifically the service_token authentication path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority authentication bypass, not a high-CVSS/low-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 0.1.3 - upgrade nimble_zta to 0.1.3 or later, which is the exact fixed version cited in the advisory range and corresponds to patch commit 6458fd18a5ba41166d4973214c519e98fe05b72d (see https://github.com/dashbitco/nimble_zta/security/advisories/GHSA-rj24-g8cc-g7g2, https://cna.erlef.org/cves/CVE-2026-91187.html and https://osv.dev/vulnerability/EEF-CVE-2026-91187). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and services that depend on nimble_zta and confirm which are using the Cloudflare Zero Trust service-token strategy, then identify the deployed version of nimble_zta in each; treat any instance at 0.1.2 or earlier as compromised-capable and prioritize remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Share
External POC / Exploit Code
Leaving vuln.today