Improper Cryptographic Signature Verification in Guardian by ueberauth

CVE-2026-55735

What is CVE-2026-55735?

The Guardian by ueberauth is susceptible to a vulnerability that allows unauthenticated attackers to revoke legitimate sessions using a forged JSON Web Token (JWT). This flaw arises from improper verification of the JWT's cryptographic signature during the revocation process, specifically in the revoke/3 function. An attacker can exploit this by creating a JWT with the right claim values and submit it, circumventing the signature check, which can lead to the unauthorized termination of a victim's session. This poses a significant risk to user session integrity and application security.

References