p PatchFirst

CVE-2026-55165

CVE-2026-55165 · Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] from an unverified token and passed that attacker-controlled value to decode_with_multiple_secrets. PyJWT 2.x rejects alg=none with the configured key, so the flaw is a defense-in-depth gap rather than a direct authentication bypass in the shipped configuration. The unpinned algorithm can become exploitable after an asymmetric-signing migration through algorithm confusion, and it weakens algorithm-based anomaly detection because the token chooses the recorded value. A separate disclosure of LEMUR_TOKEN_SECRET would also permit forged HS256 tokens, although that disclosure is an independent prerequisite. The fix introduces the server-controlled LEMUR_TOKEN_ALGORITHMS allowlist and defaults it to HS256. This issue is fixed in version 1.9.2.

CVSS 4.8 · Media · EPSS 0,2% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • lemur

    Versiones
    • < 1.9.2: Afectada

    Sin corrección publicada

  • lemur PyPI

    Versiones
    • 0.11.0
    • 0.2.1
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.9.0
    • 1.9.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.9.2

    Actualiza a 1.9.2

Fuentes originales

Comprueba tu servidor →