Proof of Possession Bypass in Siglet via Refresh Token Handler

Executive Summary

This vulnerability is a proof-of-possession bypass in the Eclipse Data Plane Core project. It allows an attacker with a valid refresh token and access token pair to forge a bound token signed with an arbitrary keypair. The attacker can publish a public key at a did:web: host they control and manipulate iss and kid claims to bypass the proof-of-possession mechanism.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the JWT token handling in Siglet versions affected by CVE-2026-88819. Check if the renew() function properly validates the issuer DID in refresh tokens. Look for tokens with mismatched issuer claims or unsigned tokens. Review logs for unauthorized token renewals or tokens issued with arbitrary keypairs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this vulnerability to mint new access tokens indefinitely without the legitimate client's private key. This could lead to unauthorized access to resources protected by the tokens, potentially allowing the attacker to impersonate the legitimate user or escalate privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and potential legal or financial penalties due to compromised access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update to the latest version of Siglet that includes a fix for the refresh token handler proof-of-possession bypass. Review all refresh and access tokens in use and invalidate any potentially compromised tokens. Ensure the renew() function now verifies the iss claim matches the legitimate client's identity.

Useful 0 Not Useful 0