CWE-706
Allowed-with-ReviewUse of Incorrectly-Resolved Name or Reference
Abstraction: Class · Status: Incomplete
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
196 vulnerabilities reference this CWE, most recent first.
GHSA-QM9X-V7CX-7RQ4
Vulnerability from github – Published: 2026-03-26 19:08 – Updated: 2026-04-10 19:37Summary
Allow-always exec approvals did not unwrap /usr/bin/time, so an unregistered time wrapper could bypass executable binding and reuse approval state for the inner command.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2(630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
39409b6a6dd4239deea682e626bac9ba547bfb14
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- src/infra/dispatch-wrapper-resolution.ts now unwraps /usr/bin/time and binds approvals to the real inner executable.
- src/infra/exec-approvals-allow-always.test.ts ships regression coverage for time-wrapper allow-always approval bypasses.
OpenClaw thanks @YLChen-007 for reporting.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35666"
],
"database_specific": {
"cwe_ids": [
"CWE-706",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-26T19:08:45Z",
"nvd_published_at": "2026-04-10T17:17:08Z",
"severity": "HIGH"
},
"details": "## Summary\nAllow-always exec approvals did not unwrap /usr/bin/time, so an unregistered time wrapper could bypass executable binding and reuse approval state for the inner command.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: \u003c 2026.3.22\n- Fixed: \u003e= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `39409b6a6dd4239deea682e626bac9ba547bfb14`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/infra/dispatch-wrapper-resolution.ts now unwraps /usr/bin/time and binds approvals to the real inner executable.\n- src/infra/exec-approvals-allow-always.test.ts ships regression coverage for time-wrapper allow-always approval bypasses.\n\nOpenClaw thanks @YLChen-007 for reporting.",
"id": "GHSA-qm9x-v7cx-7rq4",
"modified": "2026-04-10T19:37:43Z",
"published": "2026-03-26T19:08:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qm9x-v7cx-7rq4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35666"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/39409b6a6dd4239deea682e626bac9ba547bfb14"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-unregistered-time-dispatch-wrapper"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw\u0027s system.run allowlist can be bypassed through an unregistered time dispatch wrapper"
}
GHSA-QR79-4QWM-2CWC
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter.
{
"affected": [],
"aliases": [
"CVE-2021-35337"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-706"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-01T14:15:00Z",
"severity": "MODERATE"
},
"details": "Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter.",
"id": "GHSA-qr79-4qwm-2cwc",
"modified": "2022-05-24T19:06:42Z",
"published": "2022-05-24T19:06:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35337"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/50050"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QW9G-7549-7WG5
Vulnerability from github – Published: 2024-03-01 16:58 – Updated: 2024-03-01 18:58Password reset vulnerable to accent confusion
The password reset mechanism of the Directus backend is implemented in a way where combined with (specific, need to double check if i can work around) configuration in MySQL or MariaDB. As such, it allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents.
This is due to the fact that by default MySQL/MariaDB are configured for accent-insenstive and case-insensitve comparisons.
MySQL weak comparison:
select 1 from directus_users where 'julian@cure53.de' = 'julian@cüre53.de';
This is exploitable due to an error in the API using the supplied email address for sending the reset password mail instead of using the email from the database.
Steps to reproduce:
- If the attacker knows the email address of the victim user, i.e.,
julian@cure53.de. (possibly just the domain could be enough for an educated guess) - A off-by-one accented domain
cüre53.decan be registered to be able to receive emails. - With this email the attacker can request a password reset for
julian@cüre53.de.
POST /auth/password/request HTTP/1.1
Host: example.com
[...]
{"email":"julian@cüre53.de"}
- The supplied email (julian@cüre53.de) gets checked against the database and will match the non-accented email
julian@cure53.deand will continue to email the password reset link to the provided email address instead of the saved email address. - With this email the attacker can log into the target account and use it for nefarious things
Workarounds
Should be possible with collations but haven't been able to confirm this.
References
- https://www.monolune.com/articles/what-is-the-utf8mb4_0900_ai_ci-collation/
- https://dev.mysql.com/doc/refman/8.0/en/charset-unicode-sets.html
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.8.2"
},
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-27295"
],
"database_specific": {
"cwe_ids": [
"CWE-706"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-01T16:58:20Z",
"nvd_published_at": "2024-03-01T16:15:46Z",
"severity": "HIGH"
},
"details": "## Password reset vulnerable to accent confusion\n\nThe password reset mechanism of the Directus backend is implemented in a way where combined with (specific, need to double check if i can work around) configuration in MySQL or MariaDB. As such, it allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents. \n\nThis is due to the fact that by default MySQL/MariaDB are configured for accent-insenstive and case-insensitve comparisons.\n\nMySQL weak comparison:\n```sql\nselect 1 from directus_users where \u0027julian@cure53.de\u0027 = \u0027julian@c\u00fcre53.de\u0027;\n```\n\nThis is exploitable due to an error in the API using the supplied email address for sending the reset password mail instead of using the email from the database.\n\n### Steps to reproduce:\n\n1. If the attacker knows the email address of the victim user, i.e., `julian@cure53.de`. (possibly just the domain could be enough for an educated guess)\n2. A off-by-one accented domain `c\u00fcre53.de` can be registered to be able to receive emails.\n3. With this email the attacker can request a password reset for `julian@c\u00fcre53.de`. \n```http\nPOST /auth/password/request HTTP/1.1\nHost: example.com\n[...]\n{\"email\":\"julian@c\u00fcre53.de\"}\n```\n4. The supplied email (julian@c\u00fcre53.de) gets checked against the database and will match the non-accented email `julian@cure53.de` and will continue to email the password reset link to the provided email address instead of the saved email address.\n5. With this email the attacker can log into the target account and use it for nefarious things\n\n### Workarounds\nShould be possible with collations but haven\u0027t been able to confirm this. \n\n### References\n- https://www.monolune.com/articles/what-is-the-utf8mb4_0900_ai_ci-collation/\n- https://dev.mysql.com/doc/refman/8.0/en/charset-unicode-sets.html\n\n",
"id": "GHSA-qw9g-7549-7wg5",
"modified": "2024-03-01T18:58:40Z",
"published": "2024-03-01T16:58:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/directus/directus/security/advisories/GHSA-qw9g-7549-7wg5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27295"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/a8ef790ea2d28b1727f9027d99bd360920d57919"
},
{
"type": "WEB",
"url": "https://dev.mysql.com/doc/refman/8.0/en/charset-unicode-sets.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/directus/directus"
},
{
"type": "WEB",
"url": "https://www.monolune.com/articles/what-is-the-utf8mb4_0900_ai_ci-collation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Directus has MySQL accent insensitive email matching"
}
GHSA-QX3C-CCJ2-G7FJ
Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-09 15:35Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-87613"
],
"database_specific": {
"cwe_ids": [
"CWE-706"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T01:17:19Z",
"severity": "CRITICAL"
},
"details": "Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)",
"id": "GHSA-qx3c-ccj2-g7fj",
"modified": "2026-09-09T15:35:02Z",
"published": "2026-09-09T03:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87613"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/501889544"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R7HQ-QM3M-7MXV
Vulnerability from github – Published: 2022-05-24 17:11 – Updated: 2024-04-04 02:49An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "query_logger" Admin API request, because of a typo in the JSON validation.
{
"affected": [],
"aliases": [
"CVE-2020-10574"
],
"database_specific": {
"cwe_ids": [
"CWE-706"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-14T20:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn\u0026#39;t actually exist during a \u0026quot;query_logger\u0026quot; Admin API request, because of a typo in the JSON validation.",
"id": "GHSA-r7hq-qm3m-7mxv",
"modified": "2024-04-04T02:49:23Z",
"published": "2022-05-24T17:11:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10574"
},
{
"type": "WEB",
"url": "https://github.com/meetecho/janus-gateway/pull/1989"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RGJ4-J68M-986V
Vulnerability from github – Published: 2024-05-21 15:31 – Updated: 2025-04-30 15:30In the Linux kernel, the following vulnerability has been resolved:
ftrace: Do not blindly read the ip address in ftrace_bug()
It was reported that a bug on arm64 caused a bad ip address to be used for updating into a nop in ftrace_init(), but the error path (rightfully) returned -EINVAL and not -EFAULT, as the bug caused more than one error to occur. But because -EINVAL was returned, the ftrace_bug() tried to report what was at the location of the ip address, and read it directly. This caused the machine to panic, as the ip was not pointing to a valid memory address.
Instead, read the ip address with copy_from_kernel_nofault() to safely access the memory, and if it faults, report that the address faulted, otherwise report what was in that location.
{
"affected": [],
"aliases": [
"CVE-2021-47276"
],
"database_specific": {
"cwe_ids": [
"CWE-706"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:15Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Do not blindly read the ip address in ftrace_bug()\n\nIt was reported that a bug on arm64 caused a bad ip address to be used for\nupdating into a nop in ftrace_init(), but the error path (rightfully)\nreturned -EINVAL and not -EFAULT, as the bug caused more than one error to\noccur. But because -EINVAL was returned, the ftrace_bug() tried to report\nwhat was at the location of the ip address, and read it directly. This\ncaused the machine to panic, as the ip was not pointing to a valid memory\naddress.\n\nInstead, read the ip address with copy_from_kernel_nofault() to safely\naccess the memory, and if it faults, report that the address faulted,\notherwise report what was in that location.",
"id": "GHSA-rgj4-j68m-986v",
"modified": "2025-04-30T15:30:44Z",
"published": "2024-05-21T15:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47276"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0bc62e398bbd9e600959e610def5109957437b28"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3e4ddeb68751fb4fb657199aed9cfd5d02796875"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4aedc2bc2b32c93555f47c95610efb89cc1ec09b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6c14133d2d3f768e0a35128faac8aa6ed4815051"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7e4e824b109f1d41ccf223fbb0565d877d6223a2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/862dcc14f2803c556bdd73b43c27b023fafce2fb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/97524384762c1fb9b3ded931498dd2047bd0de81"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/acf671ba79c1feccc3ec7cfdcffead4efcec49e7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RH49-GQQX-HGQF
Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-09 15:35Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
{
"affected": [],
"aliases": [
"CVE-2026-87618"
],
"database_specific": {
"cwe_ids": [
"CWE-706"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T01:17:19Z",
"severity": "HIGH"
},
"details": "Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)",
"id": "GHSA-rh49-gqqx-hgqf",
"modified": "2026-09-09T15:35:02Z",
"published": "2026-09-09T03:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87618"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/497203958"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RH8G-J53H-G8XF
Vulnerability from github – Published: 2022-06-03 00:01 – Updated: 2024-03-27 15:30A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
{
"affected": [],
"aliases": [
"CVE-2022-27778"
],
"database_specific": {
"cwe_ids": [
"CWE-706"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-02T14:15:00Z",
"severity": "HIGH"
},
"details": "A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.",
"id": "GHSA-rh8g-j53h-g8xf",
"modified": "2024-03-27T15:30:35Z",
"published": "2022-06-03T00:01:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27778"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1553598"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220609-0009"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220729-0004"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RP9M-7R4C-75QG
Vulnerability from github – Published: 2026-04-03 04:07 – Updated: 2026-04-08 11:54NOTE: While the library exposes a mechanism which could introduce the vulnerability, this issue is created by developer-supplied code and not by the library itself. We will add a warning and some education for users around the possible issues however since the defaults work we will not be updating the library beyond that for this advisory.
Impact
Setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to:
- Valid tokens returning claims from different valid tokens
- Users being mis-identified as other users based on the wrong token
This could result in: - User impersonation - UserB receives UserA's identity and permissions - Privilege escalation - Low-privilege users inherit admin-level access - Cross-tenant data access - Users gain access to other tenants' resources - Authorization bypass - Security decisions made on wrong user identity
Affected Configurations
This vulnerability ONLY affects applications that BOTH:
- Enable caching using the cache option
- Use custom cacheKeyBuilder functions that can produce collisions
VULNERABLE examples:
// Collision-prone: same audience = same cache key
cacheKeyBuilder: (token) => {
const { aud } = parseToken(token)
return `aud=${aud}`
}
// Collision-prone: grouping by user type
cacheKeyBuilder: (token) => {
const { aud } = parseToken(token)
return aud.includes('admin') ? 'admin-users' : 'regular-users'
}
// Collision-prone: tenant + service grouping
cacheKeyBuilder: (token) => {
const { iss, aud } = parseToken(token)
return `${iss}-${aud}`
}
SAFE examples:
// Default hash-based (recommended)
createVerifier({ cache: true }) // Uses secure default
// Include unique user identifier
cacheKeyBuilder: (token) => {
const { sub, aud, iat } = parseToken(token)
return `${sub}-${aud}-${iat}`
}
// No caching (always safe)
createVerifier({ cache: false })
Not Affected
- Applications using default caching
- Applications with caching disabled
Assessment Guide
To determine if you're affected:
- Check if caching is enabled: Look for cache: true or cache: in verifier configuration
- Check for custom cache key builders: Look for cacheKeyBuilder function in configuration
- Analyze collision potential: Review if your cacheKeyBuilder can produce identical keys for different users/tokens
- If no custom cacheKeyBuilder: You are NOT affected (default is safe)
Mitigations
Mitigations include:
- Ensure uniqueness of keys produced in cacheKeyBuilder
- Remove custom cacheKeyBuilder method
- Disable caching
fast-jwt allows enabling a verification cache through the cache option. The cache key is derived from the token via cacheKeyBuilder.
When a custom cacheKeyBuilder produces collisions between different tokens, the verifier may return the cached payload of a previous token instead of validating and returning the payload of the current token.
This results in cross-token payload reuse and identity confusion.
Two distinct valid JWTs can be verified successfully but mapped to the same cached entry, causing the verifier to return claims belonging to a different token.
This affects authentication and authorization decisions when applications trust the returned payload.
Affected component
src/verifier.js
Relevant logic:
cache enabled via createCache
cache population via cacheSet
lookup based on cacheKeyBuilder(token)
cached payload returned without re-verification
Impact
Identity / authorization confusion via cache collision.
If two tokens generate the same cache key:
token A is verified → payload stored in cache
token B is verified → cache hit occurs
verifier returns payload from token A instead of B
Observed effect:
subject mismatch
claim mismatch
authorization decision performed on wrong identity
Potential real-world consequences:
user impersonation (logical)
privilege confusion
incorrect RBAC evaluation
gateway / middleware auth inconsistencies
This is especially dangerous when:
cache is enabled (recommended for performance)
custom cacheKeyBuilder is used
identity claims (sub / aud / iss) drive authorization
Root cause
The verifier assumes the cache key uniquely identifies the token and its claims.
However:
cacheKeyBuilder is user-controlled
collisions are not detected
cache entries store decoded payload
cached payload is returned without binding validation
This creates a trust boundary break between:
token → cache key → cached payload
Proof of concept
Environment:
fast-jwt: 6.1.0
Node.js: v24.13.1
PoC:
const { createSigner, createVerifier } = require('fast-jwt')
const sign = createSigner({ key: 'secret' })
// Two distinct tokens const t1 = sign({ sub: 'userA', aud: 'admin' }) const t2 = sign({ sub: 'userB', aud: 'admin' })
// Deliberately unsafe cache key builder (collision) const verify = createVerifier({ key: 'secret', cache: true, cacheKeyBuilder: () => 'static-key' })
console.log('verify t1') const p1 = verify(t1) console.log('t1 PASS sub=', p1.sub)
console.log('verify t2') const p2 = verify(t2) console.log('t2 PASS sub=', p2.sub)
console.log('verify t2 again') const p3 = verify(t2) console.log('t2-again PASS sub=', p3.sub)
console.log('verify t1 again') const p4 = verify(t1) console.log('t1-again PASS sub=', p4.sub)
Observed output:
verify t1 t1 PASS sub= userA
verify t2 t2 PASS sub= userA
verify t2 again t2-again PASS sub= userA
verify t1 again t1-again PASS sub= userA
The verifier returns payload from userA when verifying userB.
Expected behavior
Cache must not allow returning claims from a different token.
Verification must remain bound to the actual token being validated.
Even if cache collisions occur, the verifier should:
revalidate signature
re-decode payload
or invalidate cache entry
Why this is not “just misuse”
This is not merely a user mistake.
Reasons:
fast-jwt explicitly exposes cacheKeyBuilder as an extension point.
The documentation suggests performance tuning via custom key builders.
No safeguards exist against collisions.
No verification binding is performed between:
cached payload
original token
The verifier trusts cache output as authoritative identity.
This creates a security-sensitive invariant:
"cache key uniqueness"
which is neither enforced nor validated.
Security-critical libraries must assume extension hooks can be misused and implement defensive checks, especially when identity decisions are derived from cached values.
Security classification
logical authorization flaw
cache confusion vulnerability
identity boundary break
Closest CWE:
CWE-440 — Expected Behavior Violation
Suggested fix (minimal and safe)
Bind cache entries to token integrity.
Option A — safest:
Store token hash along with payload and verify match before returning cache.
Conceptual patch:
const tokenHash = hashToken(token)
cache.set(key, { tokenHash, payload })
...
const entry = cache.get(key)
if (entry && entry.tokenHash === hashToken(token)) { return entry.payload }
Option B — simpler:
Disable cache usage when custom cacheKeyBuilder is provided.
Option C — defensive:
Always re-validate signature when cache hit occurs.
Notes
Default cacheKeyBuilder is safe (hash-based).
Issue appears when custom builders are used — a documented and supported feature.
Impact increases in:
API gateways
auth middleware
RBAC layers relying on payload.sub / payload.aud
This vulnerability is independent from:
RegExp statefulness issue
ReDoS claim validation issue
It is a separate flaw in cache design and trust model.
PoC did on my computer: 'use strict'
const fs = require('node:fs') const path = require('node:path') const { createSigner, createVerifier } = require('./src')
function nowSec() { return Math.floor(Date.now() / 1000) }
const sign = createSigner({ key: 'secret' }) const t1 = sign({ sub: 'userA', aud: 'admin', iat: nowSec() }) const t2 = sign({ sub: 'userB', aud: 'admin', iat: nowSec() })
function badKeyBuilder() { return 'aud=admin' }
const verify = createVerifier({ key: 'secret', cache: true, cacheTTL: 60000, cacheKeyBuilder: badKeyBuilder })
function run(tok) { try { const out = verify(tok) return { ok: true, sub: out.sub, aud: out.aud } } catch (e) { return { ok: false, code: e.code || String(e), message: e.message } } }
const results = [] results.push({ step: 'verify(t1)', token: 't1', result: run(t1) }) results.push({ step: 'verify(t2)', token: 't2', result: run(t2) }) results.push({ step: 'verify(t2) again', token: 't2', result: run(t2) }) results.push({ step: 'verify(t1) again', token: 't1', result: run(t1) })
const evidence = { title: 'fast-jwt cache confusion when cacheKeyBuilder collisions occur', environment: { node: process.version, fastJwt: require('./package.json').version }, config: { cache: true, cacheTTL: 60000, cacheKeyBuilder: "returns constant key 'aud=admin' (realistic collision pattern)" }, tokens: { t1: { claims: { sub: 'userA', aud: 'admin' }, jwt: t1 }, t2: { claims: { sub: 'userB', aud: 'admin' }, jwt: t2 } }, observed: results }
const outPath = path.join(process.cwd(), 'evidence-cache-keybuilder-confusion.json') fs.writeFileSync(outPath, JSON.stringify(evidence, null, 2)) console.log('Wrote evidence to:', outPath)
for (const r of results) {
console.log(r.step, '=>', r.result.ok ? PASS sub=${r.result.sub} : FAIL ${r.result.code})
}
Output: PS C:\Users\Franciny Rojas\Desktop\crypto-research\fast-jwt> node poc_cache_keybuilder_confusion_evidence.js Wrote evidence to: C:\Users\Franciny Rojas\Desktop\crypto-research\fast-jwt\evidence-cache-keybuilder-confusion.json verify(t1) => PASS sub=userA verify(t2) => PASS sub=userA verify(t2) again => PASS sub=userA verify(t1) again => PASS sub=userA PS C:\Users\Franciny Rojas\Desktop\crypto-research\fast-jwt>
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "fast-jwt"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.1"
},
{
"fixed": "6.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35039"
],
"database_specific": {
"cwe_ids": [
"CWE-1289",
"CWE-345",
"CWE-706"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-03T04:07:09Z",
"nvd_published_at": "2026-04-06T17:17:13Z",
"severity": "CRITICAL"
},
"details": "_NOTE_: While the library exposes a mechanism which could introduce the vulnerability, this issue is created by developer-supplied code and not by the library itself. We will add a warning and some education for users around the possible issues however since the defaults work we will not be updating the library beyond that for this advisory.\n\n## Impact\n\nSetting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to:\n\n- Valid tokens returning claims from different valid tokens\n- Users being mis-identified as other users based on the wrong token\n\nThis could result in:\n- User impersonation - UserB receives UserA\u0027s identity and permissions\n- Privilege escalation - Low-privilege users inherit admin-level access\n- Cross-tenant data access - Users gain access to other tenants\u0027 resources\n- Authorization bypass - Security decisions made on wrong user identity\n\n## Affected Configurations\n\nThis vulnerability ONLY affects applications that BOTH:\n\n1. Enable caching using the cache option\n2. Use custom cacheKeyBuilder functions that can produce collisions\n\nVULNERABLE examples:\n```\n// Collision-prone: same audience = same cache key\ncacheKeyBuilder: (token) =\u003e {\n const { aud } = parseToken(token)\n return `aud=${aud}`\n}\n\n// Collision-prone: grouping by user type\ncacheKeyBuilder: (token) =\u003e {\n const { aud } = parseToken(token)\n return aud.includes(\u0027admin\u0027) ? \u0027admin-users\u0027 : \u0027regular-users\u0027\n}\n\n// Collision-prone: tenant + service grouping\ncacheKeyBuilder: (token) =\u003e {\n const { iss, aud } = parseToken(token)\n return `${iss}-${aud}`\n}\n```\n\nSAFE examples:\n```\n// Default hash-based (recommended)\ncreateVerifier({ cache: true }) // Uses secure default\n\n// Include unique user identifier\ncacheKeyBuilder: (token) =\u003e {\n const { sub, aud, iat } = parseToken(token)\n return `${sub}-${aud}-${iat}`\n}\n\n// No caching (always safe)\ncreateVerifier({ cache: false })\n```\n### Not Affected\n\n- Applications using **default caching**\n- Applications with **caching disabled**\n \n## Assessment Guide\n\nTo determine if you\u0027re affected:\n\n1. Check if caching is enabled: Look for cache: true or cache: \u003cnumber\u003e in verifier configuration\n2. Check for custom cache key builders: Look for cacheKeyBuilder function in configuration\n3. Analyze collision potential: Review if your cacheKeyBuilder can produce identical keys for different users/tokens\n4. If no custom cacheKeyBuilder: You are NOT affected (default is safe)\n\n## Mitigations\n\nMitigations include:\n\n- Ensure uniqueness of keys produced in cacheKeyBuilder\n- Remove custom cacheKeyBuilder method\n- Disable caching\n\n---\n\nfast-jwt allows enabling a verification cache through the cache option.\nThe cache key is derived from the token via cacheKeyBuilder.\n\nWhen a custom cacheKeyBuilder produces collisions between different tokens, the verifier may return the cached payload of a previous token instead of validating and returning the payload of the current token.\n\nThis results in cross-token payload reuse and identity confusion.\n\nTwo distinct valid JWTs can be verified successfully but mapped to the same cached entry, causing the verifier to return claims belonging to a different token.\n\nThis affects authentication and authorization decisions when applications trust the returned payload.\n\nAffected component\n\nsrc/verifier.js\n\nRelevant logic:\n\ncache enabled via createCache\n\ncache population via cacheSet\n\nlookup based on cacheKeyBuilder(token)\n\ncached payload returned without re-verification\n\nImpact\n\nIdentity / authorization confusion via cache collision.\n\nIf two tokens generate the same cache key:\n\ntoken A is verified \u2192 payload stored in cache\n\ntoken B is verified \u2192 cache hit occurs\n\nverifier returns payload from token A instead of B\n\nObserved effect:\n\nsubject mismatch\n\nclaim mismatch\n\nauthorization decision performed on wrong identity\n\nPotential real-world consequences:\n\nuser impersonation (logical)\n\nprivilege confusion\n\nincorrect RBAC evaluation\n\ngateway / middleware auth inconsistencies\n\nThis is especially dangerous when:\n\ncache is enabled (recommended for performance)\n\ncustom cacheKeyBuilder is used\n\nidentity claims (sub / aud / iss) drive authorization\n\nRoot cause\n\nThe verifier assumes the cache key uniquely identifies the token and its claims.\n\nHowever:\n\ncacheKeyBuilder is user-controlled\n\ncollisions are not detected\n\ncache entries store decoded payload\n\ncached payload is returned without binding validation\n\nThis creates a trust boundary break between:\n\ntoken \u2192 cache key \u2192 cached payload\n\nProof of concept\n\nEnvironment:\n\nfast-jwt: 6.1.0\n\nNode.js: v24.13.1\n\nPoC:\n\nconst { createSigner, createVerifier } = require(\u0027fast-jwt\u0027)\n\nconst sign = createSigner({ key: \u0027secret\u0027 })\n\n// Two distinct tokens\nconst t1 = sign({ sub: \u0027userA\u0027, aud: \u0027admin\u0027 })\nconst t2 = sign({ sub: \u0027userB\u0027, aud: \u0027admin\u0027 })\n\n// Deliberately unsafe cache key builder (collision)\nconst verify = createVerifier({\n key: \u0027secret\u0027,\n cache: true,\n cacheKeyBuilder: () =\u003e \u0027static-key\u0027\n})\n\nconsole.log(\u0027verify t1\u0027)\nconst p1 = verify(t1)\nconsole.log(\u0027t1 PASS sub=\u0027, p1.sub)\n\nconsole.log(\u0027verify t2\u0027)\nconst p2 = verify(t2)\nconsole.log(\u0027t2 PASS sub=\u0027, p2.sub)\n\nconsole.log(\u0027verify t2 again\u0027)\nconst p3 = verify(t2)\nconsole.log(\u0027t2-again PASS sub=\u0027, p3.sub)\n\nconsole.log(\u0027verify t1 again\u0027)\nconst p4 = verify(t1)\nconsole.log(\u0027t1-again PASS sub=\u0027, p4.sub)\n\nObserved output:\n\nverify t1\nt1 PASS sub= userA\n\nverify t2\nt2 PASS sub= userA\n\nverify t2 again\nt2-again PASS sub= userA\n\nverify t1 again\nt1-again PASS sub= userA\n\nThe verifier returns payload from userA when verifying userB.\n\nExpected behavior\n\nCache must not allow returning claims from a different token.\n\nVerification must remain bound to the actual token being validated.\n\nEven if cache collisions occur, the verifier should:\n\nrevalidate signature\n\nre-decode payload\n\nor invalidate cache entry\n\nWhy this is not \u201cjust misuse\u201d\n\nThis is not merely a user mistake.\n\nReasons:\n\nfast-jwt explicitly exposes cacheKeyBuilder as an extension point.\n\nThe documentation suggests performance tuning via custom key builders.\n\nNo safeguards exist against collisions.\n\nNo verification binding is performed between:\n\ncached payload\n\noriginal token\n\nThe verifier trusts cache output as authoritative identity.\n\nThis creates a security-sensitive invariant:\n\n\"cache key uniqueness\"\n\nwhich is neither enforced nor validated.\n\nSecurity-critical libraries must assume extension hooks can be misused and implement defensive checks, especially when identity decisions are derived from cached values.\n\nSecurity classification\n\nlogical authorization flaw\n\ncache confusion vulnerability\n\nidentity boundary break\n\nClosest CWE:\n\nCWE-440 \u2014 Expected Behavior Violation\n\nSuggested fix (minimal and safe)\n\nBind cache entries to token integrity.\n\nOption A \u2014 safest:\n\nStore token hash along with payload and verify match before returning cache.\n\nConceptual patch:\n\nconst tokenHash = hashToken(token)\n\ncache.set(key, { tokenHash, payload })\n\n...\n\nconst entry = cache.get(key)\n\nif (entry \u0026\u0026 entry.tokenHash === hashToken(token)) {\n return entry.payload\n}\n\nOption B \u2014 simpler:\n\nDisable cache usage when custom cacheKeyBuilder is provided.\n\nOption C \u2014 defensive:\n\nAlways re-validate signature when cache hit occurs.\n\nNotes\n\nDefault cacheKeyBuilder is safe (hash-based).\n\nIssue appears when custom builders are used \u2014 a documented and supported feature.\n\nImpact increases in:\n\nAPI gateways\n\nauth middleware\n\nRBAC layers relying on payload.sub / payload.aud\n\nThis vulnerability is independent from:\n\nRegExp statefulness issue\n\nReDoS claim validation issue\n\nIt is a separate flaw in cache design and trust model.\n\nPoC did on my computer:\n\u0027use strict\u0027\n\nconst fs = require(\u0027node:fs\u0027)\nconst path = require(\u0027node:path\u0027)\nconst { createSigner, createVerifier } = require(\u0027./src\u0027)\n\nfunction nowSec() {\n return Math.floor(Date.now() / 1000)\n}\n\nconst sign = createSigner({ key: \u0027secret\u0027 })\nconst t1 = sign({ sub: \u0027userA\u0027, aud: \u0027admin\u0027, iat: nowSec() })\nconst t2 = sign({ sub: \u0027userB\u0027, aud: \u0027admin\u0027, iat: nowSec() })\n\nfunction badKeyBuilder() {\n return \u0027aud=admin\u0027\n}\n\nconst verify = createVerifier({\n key: \u0027secret\u0027,\n cache: true,\n cacheTTL: 60000,\n cacheKeyBuilder: badKeyBuilder\n})\n\nfunction run(tok) {\n try {\n const out = verify(tok)\n return { ok: true, sub: out.sub, aud: out.aud }\n } catch (e) {\n return { ok: false, code: e.code || String(e), message: e.message }\n }\n}\n\nconst results = []\nresults.push({ step: \u0027verify(t1)\u0027, token: \u0027t1\u0027, result: run(t1) })\nresults.push({ step: \u0027verify(t2)\u0027, token: \u0027t2\u0027, result: run(t2) })\nresults.push({ step: \u0027verify(t2) again\u0027, token: \u0027t2\u0027, result: run(t2) })\nresults.push({ step: \u0027verify(t1) again\u0027, token: \u0027t1\u0027, result: run(t1) })\n\nconst evidence = {\n title: \u0027fast-jwt cache confusion when cacheKeyBuilder collisions occur\u0027,\n environment: {\n node: process.version,\n fastJwt: require(\u0027./package.json\u0027).version\n },\n config: {\n cache: true,\n cacheTTL: 60000,\n cacheKeyBuilder: \"returns constant key \u0027aud=admin\u0027 (realistic collision pattern)\"\n },\n tokens: {\n t1: { claims: { sub: \u0027userA\u0027, aud: \u0027admin\u0027 }, jwt: t1 },\n t2: { claims: { sub: \u0027userB\u0027, aud: \u0027admin\u0027 }, jwt: t2 }\n },\n observed: results\n}\n\nconst outPath = path.join(process.cwd(), \u0027evidence-cache-keybuilder-confusion.json\u0027)\nfs.writeFileSync(outPath, JSON.stringify(evidence, null, 2))\nconsole.log(\u0027Wrote evidence to:\u0027, outPath)\n\nfor (const r of results) {\n console.log(r.step, \u0027=\u003e\u0027, r.result.ok ? `PASS sub=${r.result.sub}` : `FAIL ${r.result.code}`)\n}\n\nOutput:\nPS C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\u003e node poc_cache_keybuilder_confusion_evidence.js\nWrote evidence to: C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\\evidence-cache-keybuilder-confusion.json\nverify(t1) =\u003e PASS sub=userA\nverify(t2) =\u003e PASS sub=userA\nverify(t2) again =\u003e PASS sub=userA\nverify(t1) again =\u003e PASS sub=userA\nPS C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\u003e",
"id": "GHSA-rp9m-7r4c-75qg",
"modified": "2026-04-08T11:54:56Z",
"published": "2026-04-03T04:07:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35039"
},
{
"type": "WEB",
"url": "https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb"
},
{
"type": "PACKAGE",
"url": "https://github.com/nearform/fast-jwt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)"
}
GHSA-RQQ5-X99M-3PJ6
Vulnerability from github – Published: 2026-07-18 15:31 – Updated: 2026-07-18 15:31A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlist/extractBin of the file internal/tools/exec_approval.go. Executing a manipulation can lead to incorrectly-resolved name. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
{
"affected": [],
"aliases": [
"CVE-2026-16120"
],
"database_specific": {
"cwe_ids": [
"CWE-706"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-18T14:17:11Z",
"severity": "LOW"
},
"details": "A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlist/extractBin of the file internal/tools/exec_approval.go. Executing a manipulation can lead to incorrectly-resolved name. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.",
"id": "GHSA-rqq5-x99m-3pj6",
"modified": "2026-07-18T15:31:50Z",
"published": "2026-07-18T15:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16120"
},
{
"type": "WEB",
"url": "https://github.com/nextlevelbuilder/goclaw/issues/1213"
},
{
"type": "WEB",
"url": "https://github.com/nextlevelbuilder/goclaw/issues/1213#issuecomment-4760246569"
},
{
"type": "WEB",
"url": "https://github.com/nextlevelbuilder/goclaw"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-16120"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/856826"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379829"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379829/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-159: Redirect Access to Libraries
An adversary exploits a weakness in the way an application searches for external libraries to manipulate the execution flow to point to an adversary supplied library or code base. This pattern of attack allows the adversary to compromise the application or server via the execution of unauthorized code. An application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries. If an adversary can redirect an application's attempts to access these libraries to other libraries that the adversary supplies, the adversary will be able to force the targeted application to execute arbitrary code. This is especially dangerous if the targeted application has enhanced privileges. Access can be redirected through a number of techniques, including the use of symbolic links, search path modification, and relative path manipulation.
CAPEC-177: Create files with the same name as files protected with a higher classification
An attacker exploits file location algorithms in an operating system or application by creating a file with the same name as a protected or privileged file. The attacker could manipulate the system if the attacker-created file is trusted by the operating system or an application component that attempts to load the original file. Applications often load or include external files, such as libraries or configuration files. These files should be protected against malicious manipulation. However, if the application only uses the name of the file when locating it, an attacker may be able to create a file with the same name and place it in a directory that the application will search before the directory with the legitimate file is searched. Because the attackers' file is discovered first, it would be used by the target application. This attack can be extremely destructive if the referenced file is executable and/or is granted special privileges based solely on having a particular name.
CAPEC-48: Passing Local Filenames to Functions That Expect a URL
This attack relies on client side code to access local files and resources instead of URLs. When the client browser is expecting a URL string, but instead receives a request for a local file, that execution is likely to occur in the browser process space with the browser's authority to local files. The attacker can send the results of this request to the local files out to a site that they control. This attack may be used to steal sensitive authentication data (either local or remote), or to gain system profile information to launch further attacks.
CAPEC-641: DLL Side-Loading
An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.