JWKS Cache Poisoning in get-jwks by Nearform

CVE-2025-59936

What is CVE-2025-59936?

get-jwks prior to version 11.0.2 contains a vulnerability that affects the JWKS key-fetching process. Specifically, it allows an attacker to exploit the cache mechanism by ensuring that improperly validated keys from untrusted issuers can be reused. The flaw arises when the issuer claim is validated only after the keys are fetched from the cache. A malicious user can manipulate JWTs such that a chosen public key gets stored in the cache, allowing subsequent requests with an altered issuer to pass validation. This security concern has been addressed in version 11.0.2.

References