LibJWT, a C library for JSON Web Tokens, versions 3.0.0 to 3.3.2, improperly handles RSA JWKs lacking the alg parameter by using them as verification keys for HMAC-based tokens (HS256/HS384/HS512). In the OpenSSL backend, this leads to HMAC verification with a zero-length key, enabling an attacker to forge valid JWTs without possessing any secret or RSA private key. This is an algorithm confusion vulnerability affecting applications that load RSA keys from JWKS where the alg parameter is omitted (which is valid JWK syntax) and rely on the JWT header to determine the verification algorithm. The vulnerability is addressed in version 3.3.3 of libjwt. The affected product is a cloud service, and the vendor typically manages patching server-side.

An attacker can bypass authentication by forging valid JWTs without knowledge of any secret or private key due to the zero-length key HMAC verification flaw. This compromises the integrity and authenticity of JWTs validated by vulnerable versions of libjwt, potentially allowing unauthorized access or privilege escalation in affected applications. No known exploits have been reported in the wild at this time.

This vulnerability is fixed in libjwt version 3.3.3. Since libjwt is used as a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their environment is updated to version 3.3.3 or later. Patch status is confirmed by the vendor fix. No additional mitigation actions are required if the environment is updated accordingly.