{"vulnerability": "cve-2026-107720", "sightings": [{"uuid": "a0b69da3-c325-4e49-a0dc-d2fa8e4dee89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107720", "type": "seen", "source": "https://gist.github.com/alon710/bdd9ca77c66ecf18eb44553e670ffee0", "content": "# CVE-2026-107720: CVE-2026-107720: Signature Verification Bypass in NearForm fast-jwt\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107720\n\n## Summary\nCVE-2026-107720 is a critical signature verification bypass vulnerability in NearForm's fast-jwt Node.js library. Under specific configurations where the token verifier is initialized with a falsy cryptographic key (such as an empty string or null) and a non-empty algorithms allowlist, the library erroneously skips signature validation. This allows unauthenticated remote attackers to submit fabricated, unsigned JSON Web Tokens and bypass the authorization boundary of the application entirely.\n\n## TL;DR\nA flaw in fast-jwt prior to 6.3.1 allows attackers to forge JSON Web Tokens and bypass authorization checks entirely if the library is configured with a blank/null key and an explicit list of allowed algorithms.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-347 (Improper Verification of Cryptographic Signature)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.4 (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not listed\n- **Impact**: Complete authentication and authorization bypass\n\n## Affected Systems\n\n- All Node.js applications using NearForm fast-jwt versions prior to 6.3.1\n- **fast-jwt**: < 6.3.1 (Fixed in: `6.3.1`)\n\n## Mitigation\n\n- Upgrade the fast-jwt dependency to version 6.3.1 or higher immediately.\n- Implement robust environment variable validation to crash the application if cryptographic keys are resolved as empty or null.\n- Explicitly omit or restrict the use of the 'none' algorithm unless it is required by design.\n\n**Remediation Steps:**\n1. Locate the package.json file of the application and check the fast-jwt version.\n2. Execute the package manager update command: 'npm install fast-jwt@6.3.1' or equivalent.\n3. Audit the application bootstrap code to ensure that the secrets supplied to 'createVerifier' are verified as non-empty during initialization.\n4. Re-deploy the application and confirm through logging that no warning or key initialization errors are present.\n\n## References\n\n- [Official Security Advisory (GitHub)](https://github.com/nearform/fast-jwt/security/advisories/GHSA-8wpc-h4q6-8fxv)\n- [Official Fix Commit](https://github.com/nearform/fast-jwt/commit/e22a151e83bf6d5e54e281216982d204d5665534)\n- [NVD CVE Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-107720)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107720) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T11:30:30.000000Z"}]}