{"schemaVersion":3,"id":"CVE-2026-25537","aliases":["UBUNTU-CVE-2026-25537","DEBIAN-CVE-2026-25537","CGA-3qff-h4hj-w62p","CGA-47m9-g8c4-vx6r","CGA-4qp9-22g4-v4g2","CGA-73f2-crh9-q3hr","CGA-8p8x-7hp5-p7rh","CGA-942r-c9vv-rqrv","CGA-97r9-q83g-q5h5","CGA-9p5r-g3gj-3fmh","CGA-cc94-9h9w-f2c9","CGA-f33h-mg46-57qq","CGA-fj34-8j6j-hf59","CGA-fwqr-qr5f-g8p3","CGA-g464-j8cx-9rp3","CGA-hf66-hjcc-9vx7","CGA-hp84-3q7p-h5rh","CGA-hpp7-7hrq-7gfr","CGA-j2m5-79cf-v375","CGA-jhm4-v33v-gp62","CGA-jw6f-w237-7329","CGA-m4w8-r45c-r968","CGA-qf76-rgq8-7w98","CGA-rg5m-q32x-wrvq","CGA-33v5-gh8r-282g","CGA-pchm-c4rp-hwfw","GHSA-h395-gr6q-cpjc","CGA-rvqj-9x9w-rv7m","CGA-v9j6-cwhw-jm4g","CGA-vwj8-w7r2-rqr9","CGA-w5xw-7fqv-p45r"],"status":"published","duplicateOf":null,"title":null,"description":"jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks the claim as “FailedToParse”. Crucially, the validation logic treats this “FailedToParse” state identically to “NotPresent”. This means that if a check is enabled (like: validate_nbf = true), but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim, treating it as if it were not there. This allows attackers to bypass critical time-based security restrictions (like “Not Before” checks) and commit potential authentication and authorization bypasses. This issue has been patched in version 10.3.0.","dates":{"published":"2026-02-04T21:31:53.511Z","modified":"2026-02-05T20:52:48.021Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":5.5,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Crates.io","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":5.5,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00622,"percentile":0.48873,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.16099999999999995,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00461},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00622,"percentile":0.48873}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00461,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00569,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00622,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00622,"percentile":0.48873}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_KEATS_JSONWEBTOKEN","name":"Jsonwebtoken","source":"github","url":"https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-843","name":"Access of Resource Using Incompatible Type ('Type Confusion')","description":"The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/843.html"}],"affected":[{"vendor":"chainguard","product":"codex","name":"codex","label":"codex","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/codex","purlType":"apk","versions":[{"text":"< 0.148.0-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.149.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.148.0-r1 | < 0.149.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"komodo-core","name":"komodo-core","label":"komodo-core","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/komodo-core","purlType":"apk","versions":[{"text":"< 2.0.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"lakekeeper","name":"lakekeeper","label":"lakekeeper","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/lakekeeper","purlType":"apk","versions":[{"text":"< 0.12.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.12.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"lychee","name":"lychee","label":"lychee","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/lychee","purlType":"apk","versions":[{"text":"< 0.22.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.22.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.10-hf-xet","name":"py3.10-hf-xet","label":"py3.10-hf-xet","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.10-hf-xet","purlType":"apk","versions":[{"text":"< 1.2.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.11-hf-xet","name":"py3.11-hf-xet","label":"py3.11-hf-xet","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.11-hf-xet","purlType":"apk","versions":[{"text":"< 1.2.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-hf-xet","name":"py3.12-hf-xet","label":"py3.12-hf-xet","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-hf-xet","purlType":"apk","versions":[{"text":"< 1.2.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-hf-xet","name":"py3.13-hf-xet","label":"py3.13-hf-xet","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-hf-xet","purlType":"apk","versions":[{"text":"< 1.2.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"qdrant","name":"qdrant","label":"qdrant","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/qdrant","purlType":"apk","versions":[{"text":"< 1.16.3-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.3-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"sccache","name":"sccache","label":"sccache","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/sccache","purlType":"apk","versions":[{"text":"< 0.18.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.18.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"uv","name":"uv","label":"uv","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/uv","purlType":"apk","versions":[{"text":"< 0.10.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wasmcloud","name":"wasmcloud","label":"wasmcloud","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wasmcloud","purlType":"apk","versions":[{"text":"< 2.0.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zed","name":"zed","label":"zed","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zed","purlType":"apk","versions":[{"text":"< 0.223.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.223.3-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"lychee","name":"lychee","label":"lychee","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/lychee","purlType":"apk","versions":[{"text":"< 0.22.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.22.0-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"py3.10-hf-xet","name":"py3.10-hf-xet","label":"py3.10-hf-xet","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/py3.10-hf-xet","purlType":"apk","versions":[{"text":"< 1.2.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"py3.11-hf-xet","name":"py3.11-hf-xet","label":"py3.11-hf-xet","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/py3.11-hf-xet","purlType":"apk","versions":[{"text":"< 1.2.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"py3.12-hf-xet","name":"py3.12-hf-xet","label":"py3.12-hf-xet","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/py3.12-hf-xet","purlType":"apk","versions":[{"text":"< 1.2.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"py3.13-hf-xet","name":"py3.13-hf-xet","label":"py3.13-hf-xet","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/py3.13-hf-xet","purlType":"apk","versions":[{"text":"< 1.2.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"qdrant","name":"qdrant","label":"qdrant","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/qdrant","purlType":"apk","versions":[{"text":"< 1.16.3-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.3-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"sccache","name":"sccache","label":"sccache","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/sccache","purlType":"apk","versions":[{"text":"< 0.18.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.18.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"uv","name":"uv","label":"uv","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/uv","purlType":"apk","versions":[{"text":"< 0.10.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.2-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"wasmcloud","name":"wasmcloud","label":"wasmcloud","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/wasmcloud","purlType":"apk","versions":[{"text":"< 2.0.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zed","name":"zed","label":"zed","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zed","purlType":"apk","versions":[{"text":"< 0.223.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.223.3-r0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"jsonwebtoken","name":"jsonwebtoken","label":"jsonwebtoken","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/jsonwebtoken","purlType":"cargo","versions":[{"text":"< 10.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 10.3.0","eol":null,"hubHref":null},{"vendor":"debian","product":"rust-jsonwebtoken","name":"rust-jsonwebtoken","label":"rust-jsonwebtoken","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/rust-jsonwebtoken","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"rust-jsonwebtoken","name":"rust-jsonwebtoken","label":"rust-jsonwebtoken","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/rust-jsonwebtoken","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"keats","product":"jsonwebtoken","name":"jsonwebtoken","label":"jsonwebtoken","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 10.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 10.3.0","eol":null,"hubHref":"/vendor/keats/jsonwebtoken"}],"affectedCount":27,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc","label":"github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/Keats/jsonwebtoken/commit/abbc3076742c4161347bc6b8bf4aa5eb86e1dc01","label":"github.com/Keats/jsonwebtoken/commit/abbc3076742c4161347bc6b8bf4aa5eb86e1dc01","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB","Patch"]},{"url":"https://ubuntu.com/security/CVE-2026-25537","label":"ubuntu.com/security/CVE-2026-25537","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25537","label":"www.cve.org/CVERecord?id=CVE-2026-25537","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25537","label":"security-tracker.debian.org/tracker/CVE-2026-25537","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25537.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25537.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25537","label":"nvd.nist.gov/vuln/detail/CVE-2026-25537","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/Keats/jsonwebtoken","label":"github.com/Keats/jsonwebtoken","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-GPJX-P7HC-6RC6"]},"timeline":[{"kind":"published","date":"2026-02-04T21:31:53.511Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-05T20:52:48.021Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:45:45.852Z","stale":false,"partial":false}}