Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity. This issue affects nimble_zta: from 0.1.2 before 0.1.3.
CVE-2026-91187
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-91187
nimble_zta
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
nimble_zta
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/dashbitco/nimble_zta",
"vendor": "dashbit",
"modules": [
"'Elixir.NimbleZTA.Cloudflare'"
],
"product": "nimble_zta",
"versions": [
{
"status": "affected",
"version": "0.1.2",
"lessThan": "0.1.3",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/nimble_zta",
"packageName": "nimble_zta",
"programFiles": [
"lib/nimble_zta/cloudflare.ex"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.NimbleZTA.Cloudflare':authenticate/3"
},
{
"name": "'Elixir.NimbleZTA.Cloudflare':verify_token/2"
}
]
},
{
"cpes": [
"cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/dashbitco/nimble_zta",
"vendor": "dashbit",
"modules": [
"'Elixir.NimbleZTA.Cloudflare'"
],
"product": "nimble_zta",
"versions": [
{
"status": "affected",
"version": "bc004b70985ae5763901baab3a4e204047899768",
"lessThan": "6458fd18a5ba41166d4973214c519e98fe05b72d",
"versionType": "git"
}
],
"packageURL": "pkg:github/dashbitco/nimble_zta",
"packageName": "dashbitco/nimble_zta",
"programFiles": [
"lib/nimble_zta/cloudflare.ex"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.NimbleZTA.Cloudflare':authenticate/3"
},
{
"name": "'Elixir.NimbleZTA.Cloudflare':verify_token/2"
}
]
}
]- Related CVEs
- CVE-2026-91187
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #1739 · Revision 1
- Added to Heist Feed
- Publisher date