CVE-2026-34240: 
NixOS vulnerability analysis and mitigation

CVE-2026-34240 is a JWT/JWS token forgery vulnerability in the jose Dart library (appsup-dart/jose) caused by improper acceptance of untrusted JWK header keys during signature verification. It affects all versions up to and including 0.3.5, and was disclosed on March 31, 2026, with a patch released the same day as version 0.3.5+1. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Security Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). In the vulnerable _allKeys method of JsonWebKeyStore, the library's key selection logic yielded the jwk parameter from the JOSE header as a candidate verification key, even when that key was not registered in the application's trusted key store. Since JOSE headers are attacker-controlled untrusted input, an adversary could craft a token with an arbitrary public key embedded in the jwk header field, sign it with the corresponding private key, and have the library accept the token as valid. The fix (commit b07799a) removes the line yield header.jsonWebKey! from _allKeys, ensuring only keys explicitly added to the trusted store are used for verification (Security Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to forge arbitrary JWS/JWT tokens that will be accepted as valid by any application using the affected library for token verification. This constitutes a complete integrity compromise of the authentication and authorization layer — attackers can impersonate any user or service, escalate privileges, and bypass access controls without possessing any legitimate signing key. Confidentiality and availability are not directly impacted, but the ability to forge identity tokens can enable significant lateral movement within systems that rely on JWT-based authentication (Github Advisory, Security Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Github Advisory, Feedly).

1. Identify target: Locate a Dart application using the jose package (pub.dev) at version ≤ 0.3.5 for JWT/JWS verification — this can be inferred from public package manifests (pubspec.yaml) or API behavior.
2. Generate attacker key pair: Create a new RSA or EC key pair (e.g., RS256) entirely under attacker control.
3. Craft malicious token: Build a JWT payload with desired claims (e.g., sub: admin, elevated roles, or a target user identity), and construct the JOSE protected header to include the jwk parameter containing the attacker's public key.
4. Sign the token: Sign the crafted token using the attacker's private key with the algorithm matching the embedded jwk.
5. Submit forged token: Send the forged token to the target application's authenticated endpoint. The vulnerable _allKeys method will yield the header-embedded jwk as a verification candidate and successfully validate the attacker's self-signed token.
6. Achieve objective: The application accepts the forged token as legitimate, granting the attacker the identity and privileges encoded in the token's claims (Security Advisory, Fix Commit).

• Network: Inbound JWT tokens containing a jwk parameter in the JOSE protected header (base64-decoded header includes "jwk":{...}) sent to authentication or API endpoints.
• Logs: Application logs showing successful token verification for users or roles not previously seen, or tokens with jwk headers that do not match any registered key in the key store; unexpected privilege escalation events in access logs.
• Application Behavior: Authenticated requests from unexpected user identities (e.g., admin accounts not previously active); tokens with issuers or subjects inconsistent with the application's expected identity providers.

Upgrade the jose Dart package to version 0.3.5+1 or later, which removes the untrusted jwk header key from the verification candidate pool (Security Advisory, Fix Commit). For applications that cannot patch immediately, implement a pre-verification check that rejects any incoming token whose JOSE header contains a jwk parameter unless that key is already present in the application's trusted key store. Update pubspec.yaml to pin the dependency to jose: ^0.3.5+1 and run dart pub upgrade.

The vulnerability was discovered by researcher splitline and reported to the maintainer rbellens, who published the advisory and patch on March 31, 2026 (Security Advisory). Red Hat acknowledged the CVE in their security tracking on April 2, 2026. Coverage has been limited to automated vulnerability aggregators and CVE tracking databases, with no significant broader community or media discussion observed.