CVE-2026-50218

Awaiting Analysis Awaiting Analysis - Queue

Akamai GPA Client JWT Token Injection Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: MITRE

Description

Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-50218

EUVD

EUVD-2026-100834

Affected Vendors & Products

Vendor	Product	Version / Range
Akamai	Guardicore	Platform Agent 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-99	The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper validation of JWT tokens in Akamai GPA client software before version 7.4. Attackers can exploit this by tricking users into clicking a malicious link, allowing them to inject arbitrary parameters via a spoofed JWT token. This leads to unauthorized reconfiguration and full compromise of the application's functionality.

Detection Guidance

This vulnerability involves improper JWT token validation in Akamai GPA client versions before 7.4. To detect it, check the installed version of the Akamai Guardicore Platform Agent using commands like 'dpkg -l | grep guardicore' on Debian-based systems or 'rpm -qa | grep guardicore' on RPM-based systems. If the version is below 7.4, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to take full control of the application's functionality, reconfigure it without authorization, or compromise sensitive data. Users interacting with malicious links are at risk, as are already seeded clients if the attacker knows the IDP enrollment URL.

Compliance Impact

This vulnerability could lead to unauthorized access and full compromise of application functionality, which may result in data breaches or unauthorized data exposure. Such incidents could violate GDPR's data protection requirements and HIPAA's safeguards for protected health information, potentially leading to non-compliance with these regulations.

Mitigation Strategies

Update Akamai GPA client to version 7.4 or later to ensure proper JWT token validation. Remove any seeded configurations if they may have been compromised and re-seed clients securely.

Hi! I’m here to help you understand CVE-2026-50218. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70