Path Traversal Vulnerability in SmallRye JWT for AWS Application Load Balancers

CVE-2026-81829

What is CVE-2026-81829?

A vulnerability exists in the SmallRye JWT’s AwsAlbKeyResolver component, which is responsible for validating JSON Web Tokens (JWTs) signed by AWS Application Load Balancers. The issue arises when the resolver constructs the key-fetch URL using the attacker-controlled 'kid' header parameter from the incoming JWT. This construction lacks proper sanitization of path traversal characters and query-string separators, allowing an attacker to manipulate the URL. This manipulation could lead to unauthorized GET requests targeting arbitrary paths within the same origin as the configured key endpoint. Consequently, sensitive and non-public data may be exposed to attackers prior to the JWT signature verification, posing a significant security risk to affected applications.

References