{
  "ticket_id": "CVE-2026-44699",
  "code_root": "external/libjwt",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-44699",
    "advisory_id": "GHSA-q843-6q5f-w55g",
    "advisory_url": "https://github.com/benmcollins/libjwt/security/advisories/GHSA-q843-6q5f-w55g",
    "vendor": "benmcollins",
    "product": "libjwt",
    "repo": "https://github.com/benmcollins/libjwt"
  },
  "facts": {
    "cve_id": "CVE-2026-44699",
    "advisory_id": "GHSA-q843-6q5f-w55g",
    "issue_summary": "JWT algorithm-confusion authentication bypass in libjwt. When an RSA JWK that lacks an 'alg' parameter is supplied as the verification key for an HMAC-signed token (HS256/HS384/HS512), libjwt accepts the RSA key for HMAC verification. The internal union key structure leaves the HMAC octet (secret) field zero-length, so HMAC verification runs with an empty key. An attacker who knows only the public JWKS can forge an HMAC token that verifies successfully, bypassing authentication.",
    "vulnerability_type": "Algorithm Confusion / Authentication Bypass",
    "suspected_cwe": ["CWE-347"],
    "affected_versions": "3.0.0 - 3.3.2 (inclusive)",
    "fixed_versions": ["3.3.3"],
    "reproduce_version": "3.3.2",
    "verify_fixed_version": "3.3.3",
    "repo_url": "https://github.com/benmcollins/libjwt.git",
    "code_root": "external/libjwt",
    "language": "C",
    "affected_algorithms": ["HS256", "HS384", "HS512"],
    "attacker_access": "Any attacker who knows the public JWKS used by the target (an RSA JWK with no 'alg' field).",
    "exploit_outline": "Take an RSA public JWK that has no 'alg' parameter. Forge an HS256 JWT and sign it with an empty HMAC key. Pass the RSA JWK to libjwt as the verification key for the forged HMAC token. On 3.3.2 libjwt accepts the RSA JWK for HMAC verification with a zero-length secret, so the forged token verifies successfully.",
    "vulnerable_indicator": "On libjwt 3.3.2, verifying the forged HS256 token against the RSA JWK (no 'alg') succeeds: the verification call returns success and the harness exits 0.",
    "fixed_indicator": "On libjwt 3.3.3, the same verification is rejected: the verification call returns a failure and the harness exits non-zero.",
    "reproduction_requirements": "A C toolchain to build libjwt 3.3.2 and 3.3.3, libjwt's crypto backend dependency (e.g. OpenSSL/GnuTLS), and a small C harness that constructs the RSA JWK, the forged HS256 token, and invokes libjwt's verification API. No network service or database required - the difference is observable purely in-process.",
    "notes": "Build the same C harness against both libjwt versions. The forged token must use an HMAC algorithm (HS256/384/512) while the supplied key is an RSA JWK with no 'alg' field; this is the exact mismatch the union-key bug fails to reject."
  }
}