Improper Validation of JWT Tokens in Akamai's Guardicore Platform Agent

CVE-2026-50218

What is CVE-2026-50218?

The Akamai Guardicore Platform Agent (GPA) client, available on all platforms prior to version 7.4, fails to properly validate JSON Web Tokens (JWT) used for seeding. This oversight allows attackers to craft spoofed JWT tokens by enticing users to click on malicious links. Such interaction enables the attacker to inject arbitrary parameters into the GPA client, leading to unauthorized reconfiguration and potentially complete compromise of the application’s functionality. Additionally, if an attacker is aware of the Identity Provider (IDP) URL that was used for enrollment, they can specifically target an already seeded client, heightening the risk of exploitation.

References