CVE-2026-91187
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity. This issue affects nimble_zta: from 0.1.2 before 0.1.3.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
nimble_zta
- Vendor
- dashbit
- Product
- nimble_zta
- Platforms
- Unknown
- Default status
unaffected- Package
- nimble_zta
- Package collection
- https://repo.hex.pm
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0.1.2 | affected | semver | 0.1.3 | Unavailable | None listed |
nimble_zta
- Vendor
- dashbit
- Product
- nimble_zta
- Platforms
- Unknown
- Default status
unaffected- Package
- dashbitco/nimble_zta
- Package collection
- https://github.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| bc004b70985ae5763901baab3a4e204047899768 | affected | git | 6458fd18a5ba41166d4973214c519e98fe05b72d | Unavailable | None listed |