The vulnerability in dashbit nimble_zta (versions >=0.1.2 <0.1.3) is due to improper verification of cryptographic signatures (CWE-347). Specifically, the verify_token/2 function in lib/nimble_zta/cloudflare.ex incorrectly handles the result of JOSE.JWT.verify/2 by ignoring the boolean verification outcome and returning the decoded token even if signature verification fails. An attacker can exploit this by sending a forged JWT in the cf-access-jwt-assertion header with the expected issuer and service token claims, which the system then accepts as authenticated identity. This allows unauthenticated remote attackers to authenticate as arbitrary Cloudflare service tokens.

An unauthenticated remote attacker can bypass signature verification and impersonate any Cloudflare service token, potentially gaining unauthorized access to resources protected by the Cloudflare Zero Trust authentication strategy. This represents a critical security risk due to the complete bypass of authentication controls.

A patch is available for this vulnerability. Users should upgrade nimble_zta to version 0.1.3 or later where this issue is fixed. Since this is a cloud service-related component, verify with the vendor whether the cloud-hosted service has been updated accordingly. No additional mitigation steps are indicated beyond applying the official fix.