CVE-2026-65625
Received Received - Intake

Authentication Tag Forgery in jose Erlang AES-GCM Fallback

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds. This issue affects jose: from 1.2.0 before 1.11.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-65625
EUVD
EUVD-2026-110303

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
potatosalad jose 1.2.0
potatosalad jose 8848b172575fb7d7e1e2977e8ae0a21678d2157a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-354 The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the erlang-jose library allows an attacker to forge encrypted tokens by truncating the authentication tag to as few as 8 bits. The library did not enforce the required 128-bit tag length, reducing forgery resistance from 2^-128 to 2^-8. This enables brute-forcing valid tokens without knowing the encryption key.

Detection Guidance

Detecting this vulnerability requires checking if your system uses the vulnerable jose library versions (1.2.0 to 1.11.12) and if AES-GCM decryption relies on the pure-Erlang fallback. Inspect installed Erlang/OTP versions and jose library versions. If using FIPS builds, stripped, or older OTP releases, the fallback path is likely active. No specific commands are provided in the context.

Impact Analysis

If you use the erlang-jose library versions 1.2.0 to 1.11.12, an attacker could forge JWE tokens that your system accepts as authentic. This bypasses integrity checks, allowing unauthorized data access or manipulation. The attack is feasible only when AES-GCM is handled by the pure-Erlang fallback, such as in FIPS builds or older OTP environments.

Compliance Impact

This vulnerability compromises data integrity, which is critical for GDPR and HIPAA compliance. It allows unauthorized modification of encrypted data, violating integrity requirements. Organizations using affected versions may fail compliance audits due to insufficient cryptographic protections.

Mitigation Strategies
  • Upgrade the jose library to version 1.11.13 or later to enforce strict 128-bit tag length validation.
  • Ensure native AES-GCM support is enabled in your Erlang/OTP environment to avoid falling back to the vulnerable pure-Erlang implementation.
  • Review JWE decryption processes handling attacker-controlled tokens, especially in FIPS or stripped OTP builds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart