CVE-2026-107720

Deferred Deferred - Pending Action

Authentication Bypass in fast-jwt via Unsigned JWT

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is false, and the empty signature avoids the verifySignature gate. An attacker can therefore submit a token containing arbitrary claims without possessing a signing key, resulting in authentication or authorization bypass. Claim validators still run, and non-empty keys, an empty key without algorithms, and the async key resolver path do not have this behavior. This issue is fixed in version 6.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107720

Affected Vendors & Products

Vendor	Product	Version / Range
nearform	fast-jwt	< 6.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

fast-jwt before version 6.3.1 has a flaw where createVerifier incorrectly accepts unsigned JWTs when the key is empty or null and algorithms are specified. This bypasses signature verification, allowing attackers to forge tokens with arbitrary claims without a valid signing key.

Detection Guidance

To detect this vulnerability, check if your system uses fast-jwt versions prior to 6.3.1. Inspect package.json or dependency files for the version. If using Node.js, run npm list fast-jwt to verify the installed version.

Impact Analysis

An attacker could exploit this to bypass authentication or authorization checks by submitting a fake JWT token. This may grant unauthorized access to sensitive data or functions, depending on the application's use of JWT validation.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's integrity and confidentiality principles or HIPAA's access control requirements. Organizations using affected versions may fail compliance audits.

Mitigation Strategies

Immediately upgrade fast-jwt to version 6.3.1 or later. Update dependencies in package.json and run npm update fast-jwt. Review JWT verification logic to ensure keys are properly validated and algorithms are correctly configured.

Hi! I’m here to help you understand CVE-2026-107720. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70