libjwt vulnerabilities

1 known vulnerability in libjwt from Benmcollins. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  libjwt: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2026-44699May 15, 2026Benmcollins

  LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length