SQL Injection Vulnerability in OpenSIPS with auth_jwt Module by OpenSIPS

CVE-2026-25554

What is CVE-2026-25554?

OpenSIPS versions prior to 3.6.4 that use the auth_jwt module are susceptible to a SQL injection vulnerability. This occurs in the jwt_db_authorize() function when database mode is enabled with a SQL backend. The application improperly extracts the tag claim from a JSON Web Token (JWT) without verifying its signature, and this unescaped value is directly used in a SQL query. An attacker can exploit this flaw by crafting a malicious JWT containing a harmful tag claim, leading to manipulation of the SQL query result and potential authentication bypass. This flaw enables unauthorized impersonation of user identities and poses security risks to applications relying on JWT for secure authentication.

References