The vulnerability in ueberauth guardian (versions from 1.0.0 up to but not including 2.4.1) is due to the revoke/3 function in lib/guardian.ex using peek/1 to decode JWT tokens without verifying their cryptographic signatures. This allows an attacker who can guess or know victim identifying claims (such as jti or sub) to forge a JWT with arbitrary signatures and submit it to endpoints that call revoke/3. Since revoke/3 forwards unverified claims to token module callbacks that mutate session state (e.g., whitelist deletion or blacklist insertion), the attacker can revoke the victim's session without authentication, causing a denial of service. Other related functions like refresh/2 and exchange/4 do verify signatures before acting, making revoke/3 the sole vulnerable state-mutating path.

An unauthenticated attacker can revoke a victim's session by submitting a forged token with guessed identifying claims, causing a denial of service by evicting legitimate sessions. The attacker does not require the signing secret, making the attack feasible without authentication. This impacts session integrity and availability for affected versions of ueberauth guardian.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the revoke/3 function with caller-supplied tokens or implement additional signature verification before calling revoke/3 to prevent unauthenticated session revocation.