CVE-2026-91187
Received Received - Intake

Improper Cryptographic Signature Verification in Nimble_ZTA

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: EEF

Description
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity. This issue affects nimble_zta: from 0.1.2 before 0.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-91187
EUVD
EUVD-2026-85871

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dashbit nimble_zta to 0.1.3 (exc)
dashbit nimble_zta From 0.1.2 (inc) to 0.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Verification of Cryptographic Signature issue in the NimbleZTA library. It allows unauthenticated remote attackers to bypass authentication by forging a Cloudflare service token JWT. The verify_token/2 function incorrectly discards the boolean result of signature verification and returns the decoded token even after a failed check, enabling attackers to impersonate valid service tokens.

Detection Guidance

To detect this vulnerability, check if your system is running nimble_zta version 0.1.2. Inspect the version in your project's dependency file or run commands like 'mix deps' in Elixir or 'rebar3 deps' in Erlang to list installed versions.

Impact Analysis

An attacker could gain unauthorized access to applications using the Cloudflare Zero Trust authentication strategy. This could lead to data breaches, unauthorized actions, or complete system compromise depending on the application's permissions. The high CVSS score of 9.3 indicates significant risk to confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR (data breaches) and HIPAA (unauthorized access to protected health information). Organizations using affected versions may face regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade nimble_zta to version 0.1.3 or later. As a temporary workaround, disable the Cloudflare authentication strategy or manually verify JWTs by checking the boolean result of JOSE.JWT.verify/2 before processing tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart