CVE-2026-78426: CWE-863 Incorrect Authorization in go neuvector
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.
AI Analysis
Technical Summary
NeuVector's JWT verifier accepts noncanonical Base64URL encodings of the RSA signature field, which enables an attacker holding a valid JWT that has been logged out to continue using the token until its natural expiration. This occurs because the verifier treats different Base64URL encodings of the same signature as equivalent, bypassing logout enforcement. The issue is classified as CWE-863 (Incorrect Authorization).
Potential Impact
An attacker who has a valid JWT token that has been logged out can continue to use the token until it expires, potentially maintaining unauthorized access during that period. The impact is limited to continued access with a token that should have been invalidated by logout, with low confidentiality and integrity impact and no availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional token revocation mechanisms or reducing token validity periods to limit exposure.
CVE-2026-78426: CWE-863 Incorrect Authorization in go neuvector
Description
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.
CVSS v3.1
Score 3.7low
Affected software
go
neuvector
pkg:golang/github.com/neuvector/neuvectorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
NeuVector's JWT verifier accepts noncanonical Base64URL encodings of the RSA signature field, which enables an attacker holding a valid JWT that has been logged out to continue using the token until its natural expiration. This occurs because the verifier treats different Base64URL encodings of the same signature as equivalent, bypassing logout enforcement. The issue is classified as CWE-863 (Incorrect Authorization).
Potential Impact
An attacker who has a valid JWT token that has been logged out can continue to use the token until it expires, potentially maintaining unauthorized access during that period. The impact is limited to continued access with a token that should have been invalidated by logout, with low confidentiality and integrity impact and no availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional token revocation mechanisms or reducing token validity periods to limit exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- suse
- Date Reserved
- 2026-08-24T15:33:13.665Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aabb71755bf5e2cf52afd13
Added to database: 09/17/2026, 09:47:03 UTC
Last enriched: 09/17/2026, 10:01:51 UTC
Last updated: 09/17/2026, 15:39:29 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.