JWT Claims Validation Bypass in HashiCorp Cap Library
CVE-2026-19194
5.9MEDIUM
What is CVE-2026-19194?
The HashiCorp Cap JWT Validation Library versions prior to 0.14.0 are susceptible to a claims validation bypass. This vulnerability allows malicious actors to manipulate JWT claims, potentially causing applications to make erroneous authorization decisions based on unvalidated claim values. The risk is heightened when attackers control the claim values in a JWT that is signed by a key trusted by the application. This issue has been addressed in version 0.14.0, which resolves the claims validation bypass vulnerability.
Affected Version(s)
Shared library 64 bit 0 < 0.14.0
References
CVSS V3.1
Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was reported to HashiCorp by anaximand3r and doyensec-mohamed.