Security Flaw in TLS Certificate Management by Lemur

CVE-2026-55165

What is CVE-2026-55165?

The vulnerability within Lemur's JWT verifier arises from its handling of unverified tokens, specifically the use of fetch_token_header to read critical algorithm data from an attacker-controlled token. This flaw exposes weaknesses in algorithm-based anomaly detection and poses a risk during asymmetric-signing migrations due to potential exploitation through algorithm confusion. Although configurations in PyJWT 2.x reject certain algorithm values, the lack of a rigorous algorithm validation process results in a defense-in-depth gap that could be exploited, especially if the LEMUR_TOKEN_SECRET is compromised. The vulnerability has been addressed in version 1.9.2, which implements an allowlist for server-controlled algorithms, setting it by default to HS256.

References