CVE-2026-25554: 
Linux Fedora vulnerability analysis and mitigation

CVE-2026-25554 is a SQL injection vulnerability in OpenSIPS versions 3.1 through 3.6.3 (before 3.6.4) within the auth_jwt module, specifically in the jwt_db_authorize() function in modules/auth_jwt/authorize.c. The flaw allows unauthenticated remote attackers to bypass JWT authentication and impersonate arbitrary identities when db_mode is enabled with a SQL database backend. It was discovered by Pavel Kohout of Aisle Research, with the fix merged on February 2, 2026, and publicly disclosed on February 25, 2026. The CVSSv3.1 base score is 6.5 (Medium) and the CVSSv4.0 base score is 8.3 (High), both assigned by VulnCheck (VulnCheck Advisory, Red Hat Bugzilla).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The jwt_db_authorize() function decodes a JWT token without first verifying its signature, extracts the tag claim, and interpolates it directly into a raw SQL query without any escaping or sanitization (GitHub PR #3807). An attacker can craft a JWT containing a malicious tag claim — for example, ' UNION SELECT 'admin','attacker_secret' -- — to inject their own secret into the query result; since this injected secret is subsequently used to verify the JWT signature, the attacker can sign their token with the known secret and achieve full authentication bypass (GitHub Commit 3822d33). Exploitation requires that db_mode is enabled in the auth_jwt module configuration and that a SQL database backend is in use; no prior authentication or user interaction is needed. The fix applies escape_common() to sanitize the tag value before SQL query construction (GitHub Commit 3822d33).

Successful exploitation allows an unauthenticated attacker to completely bypass JWT-based authentication in OpenSIPS, enabling impersonation of arbitrary identities and unauthorized access to protected SIP resources and services. The primary impact is high confidentiality loss (access to protected communications and user data) and low integrity impact (ability to inject manipulated query results). Since OpenSIPS is commonly deployed as a SIP proxy or session border controller in VoIP infrastructure, a successful attack could enable toll fraud, eavesdropping on SIP sessions, or unauthorized call routing (VulnCheck Advisory, Feedly).

1. Reconnaissance: Identify OpenSIPS deployments (versions 3.1–3.6.3) using network scanning tools such as Shodan or Censys, targeting SIP services (typically UDP/TCP port 5060). Confirm the target uses the auth_jwt module with db_mode enabled.
2. Craft a malicious JWT: Create a JWT token with a manipulated tag claim containing a SQL injection payload. Since the function does not verify the JWT signature before extracting the tag, any syntactically valid JWT structure is sufficient. Example tag claim value: ' UNION SELECT 'admin','attacker_secret' --
3. Sign the JWT with the injected secret: The SQL injection payload causes the database query to return an attacker-controlled secret (e.g., attacker_secret). Sign the crafted JWT using this known secret so that subsequent signature verification succeeds.
4. Send the crafted JWT in a SIP request: Submit the malicious JWT in a SIP INVITE or REGISTER request to the OpenSIPS server's authentication endpoint, triggering the jwt_db_authorize() function.
5. Authentication bypass achieved: The server validates the JWT signature against the attacker-injected secret, grants authentication, and the attacker is now impersonating the target identity (e.g., admin) with full access to protected SIP resources (GitHub PR #3807, Aisle Research Blog).

• Network: Unusual or malformed SIP REGISTER/INVITE requests containing JWT tokens with anomalous tag claim values (e.g., SQL metacharacters such as single quotes, UNION, SELECT, -- comment sequences); unexpected SIP authentication successes from unknown or untrusted IP addresses.
• Logs: OpenSIPS debug logs (opensips.log) showing JWT tag claim values containing SQL syntax or special characters; database query logs recording unexpected UNION SELECT or similar injection patterns in JWT-related queries; authentication success events for identities not matching expected user accounts.
• Database: Unexpected or anomalous query patterns in the SQL database backend associated with the auth_jwt module tables; queries returning results inconsistent with stored credentials.
• Process/Application: OpenSIPS log entries with LM_DBG messages showing escaped tag values that differ significantly from expected tag formats, which may indicate attempted injection that was blocked post-patch, or pre-patch exploitation attempts visible in unescaped query logs (GitHub Commit 3822d33, Aisle Research Blog).

The primary remediation is to upgrade OpenSIPS to version 3.6.4 or later, which includes the fix from commit 3822d33 (OpenSIPS ChangeLog, GitHub Commit 3822d33). If immediate patching is not possible, disable db_mode in the auth_jwt module configuration to eliminate the vulnerable code path, or restrict network access to OpenSIPS instances using firewall rules or network segmentation. Fedora 42 packages are also being updated to include the backported fix (Red Hat Bugzilla). Monitor OpenSIPS and database logs for suspicious JWT tag claim values as a detection measure during the remediation window.

The vulnerability was discovered and reported by Pavel Kohout of Aisle Research, who published a detailed technical deep-dive blog post (Aisle Research Blog). The finding was shared on the security-focused Mastodon instance infosec.exchange and discussed on Reddit's r/netsec community, indicating moderate interest among security practitioners. Linux security news outlets including Linux Security and Pro-Linux covered the Fedora package updates addressing the vulnerability. No major vendor statements beyond the patch release and Red Hat bugzilla tracking have been observed.