The vulnerability arises because the RevokeTokenChange.change/3 function decodes the token using AshAuthentication.Jwt.peek/1, which calls Joken.peek_claims/1 without verifying the token's cryptographic signature. This leads to acceptance of attacker-controlled claims such as jti, exp, and sub without validation. An attacker can forge a token that reuses a legitimate jti but backdates the exp claim, causing the revocation record to appear expired and be removed by expunge_expired. Consequently, the genuine token is no longer considered revoked. Arbitrary jti and sub values can also be inserted, potentially corrupting the token revocation data.

An attacker can bypass token revocation mechanisms, allowing revoked tokens to remain valid. This undermines the security controls intended to invalidate tokens, potentially enabling unauthorized access or token misuse. Additionally, arbitrary data can be inserted into the token revocation resource, which may affect system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions or implement additional signature verification on tokens before processing revocation. Monitor vendor channels for updates and apply patches promptly once released.