CVE-2026-62374
Description
A flaw was found in SD JWT JS. An attacker can bypass authorization controls by submitting tampered token disclosures. When processing Selective Disclosure JSON Web Tokens (SD-JWT), the library silently discards modified or malformed disclosures instead of rejecting the token, while still treating the overall signature as valid. A remote attacker can exploit this behavior to omit restrictive claims, such as age or role constraints, which may cause relying applications to improperly grant access.
Statement
This vulnerability is rated as Moderate severity because exploiting the issue requires an attacker to possess valid token presentation capabilities and relies on verifiers using negative authorization models where the absence of a constraint grants privilege. In standard production environments, relying applications generally enforce explicit positive assertion of required claims, mitigating unauthorized elevation. Furthermore, the affected JavaScript library is not included or deployed in core Red Hat enterprise distributions.
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Modify Application Data; Other
Integrity checks usually use a secret key that helps authenticate the data origin. Skipping integrity checking generally opens up the possibility that new data from an invalid source can be injected.
Integrity,Other
Technical Impact: Other
Data that is parsed and used may be corrupted.
Non-Repudiation,Other
Technical Impact: Hide Activities; Other
Without a checksum check, it is impossible to determine if any changes have been made to the data after it was sent.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
