The fast-jwt library, used for JSON Web Token implementation, is vulnerable in versions >= 0.0.1 and < 6.1.0 due to improper uniqueness in the cacheKeyBuilder method. When this method does not create unique keys for different tokens, cache collisions occur, causing the verification process to associate a token with claims from a different valid token. This flaw results in incorrect user identification and violates token authenticity verification, corresponding to CWE-345 and related weaknesses.

Exploitation of this vulnerability can cause a valid JWT to be mis-associated with claims from another token, leading to users being mis-identified as other users. This compromises confidentiality and integrity of authentication and authorization processes, potentially allowing unauthorized access to user data or actions under another user's identity. The CVSS score of 9.1 indicates a critical impact on confidentiality and integrity without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using custom cacheKeyBuilder implementations that do not guarantee unique keys per token. Review and update token verification logic to ensure uniqueness and correctness of cache keys to prevent collisions.