CVE-2026-107722: CWE-347: Improper Verification of Cryptographic Signature in nearform fast-jwt

fast-jwt, a JSON Web Token implementation, improperly verifies cryptographic signatures when RSA public keys contain non-whitespace characters before the PEM header. The detection logic trims whitespace but does not account for other characters, causing the system to fallback to HMAC verification incorrectly. This allows an attacker with knowledge of the public key bytes to sign arbitrary HS256 claims, resulting in authentication or authorization bypass. The vulnerability affects versions >=6.2.0 and <6.3.0 and is resolved in version 6.3.0 by correcting the key detection logic and allowing an asymmetric-only algorithm allowlist to prevent the attack.

An attacker who knows the RSA public key bytes can exploit this vulnerability to forge HS256 signatures, leading to authentication and authorization bypass. This compromises the integrity and trustworthiness of JWT tokens generated or verified by affected versions of fast-jwt, potentially allowing unauthorized access to protected resources.

Upgrade fast-jwt to version 6.3.0 or later, where this vulnerability is fixed. Additionally, configuring an asymmetric-only algorithm allowlist can prevent this attack. No other mitigation is required once the upgrade is applied.