CVE-2026-107720: CWE-20: Improper Input Validation in nearform fast-jwt

The fast-jwt library versions prior to 6.3.1 contain a vulnerability in the createVerifier function. When the key parameter is an empty string or null and the algorithms parameter is a non-empty allowlist, the verifier accepts unsigned JWTs. This happens because falsy synchronous keys bypass the prepareKeyOrSecret function, leaving allowedAlgorithms active while hasKey is false, allowing an empty signature to bypass the verifySignature check. Consequently, an attacker can submit tokens with arbitrary claims without possessing a valid signing key, resulting in authentication or authorization bypass. Claim validators still execute, and this behavior does not occur with non-empty keys, empty keys without algorithms, or when using the asynchronous key resolver path. The vulnerability is addressed in fast-jwt version 6.3.1.

An attacker can bypass authentication or authorization by submitting unsigned JWTs with arbitrary claims when the vulnerable conditions are met. This can lead to unauthorized access or privilege escalation in systems relying on fast-jwt for JWT verification. The vulnerability does not affect scenarios where keys are non-empty, algorithms are empty, or asynchronous key resolution is used.

Upgrade fast-jwt to version 6.3.1 or later, where this vulnerability is fixed. No other mitigation is required as the fix addresses the root cause.