GHSA-44fv-ww3r-9p4f: 
Rust vulnerability analysis and mitigation

Summary

JARM JWE did not authenticate its protected header.

Impact

a header field of a JARM response JWE could be changed in transit without the content failing to decrypt.

Affected versions

auth-framework >= 0.5.0-rc18, <= 0.5.0-rc65 and >= 0.6.0-rc41, <= 0.6.0-rc150. PATCHED VERSIONS: 0.5.0-rc68 (PR #317) and 0.6.0-rc157 (PR #316); the final releases that carry them are 0.5.0-rc71 and 0.6.0-rc159. Reasoning: the AES-256-GCM content encryption of a JARM JWE was computed without the protected header as additional authenticated data (RFC 7516 sections 5.1/5.2, step 14), so a change to the header was not detected by GCM. The decrypt path dispatches on alg/enc against a fixed allow-list (RSA-OAEP or RSA-OAEP-256 with A256GCM) and rejects anything else, so an attacker changing alg/enc gets no new algorithm; what can be changed unnoticed are other header fields (typ, cty, extra members). The integrity impact is therefore low, and only an on-path attacker on the response can use it (AC:H). It is also an interoperability defect: a standards-compliant JWE implementation on the other end cannot decrypt these tokens, nor can this crate decrypt theirs. Reachability: JARM response encryption is used when enable_jwe_encryption is set and needs the rsa-private-key-ops feature for RSA-OAEP key wrapping. Not affected: 0.1.1-0.4.43 and 0.5.0-rc1 (no JARM AES-GCM code: 20 tarballs without it plus 3 without the file). Measured set (47 of the 71 published .crate files; census: API total 71, 71 fetched): 0.5.0-rc18, 19, 25, 26, 27, 31, 45, 49, 51, 53, 60, 62, 63, 65; 0.6.0-rc41, 42, 45, 46, 47, 48, 50, 51, 52, 53, 54, 55, 69, 73, 85, 92, 97, 98, 101, 104, 106, 107, 109, 112, 114, 121, 126, 127, 128, 129, 131, 138, 150. Method: searched src/server/oidc/oidc_advanced_jarm.rs in every tarball for the call .encrypt(nonce, payload.as_bytes()) (AES-GCM with no AAD). Controls: the other 24 tarballs contain no Aes256Gcm in that file or lack the file; the fixed source (this fix) does not contain the call, and two new tests fail on the old code and pass on the new.

Patches

first published fixed versions 0.5.0-rc71 and 0.6.0-rc159 (the change itself: 0.5.0-rc68, PR #317, and 0.6.0-rc157, PR #316). The protected header is the AES-GCM AAD on both encrypt and decrypt. A JWE made by an older version carries no such binding and no longer decrypts; there is no fallback. 0.5.0-rc65 and 0.6.0-rc150 are the only live affected versions and are yanked; the other affected versions were yanked earlier. First published fixed versions: 0.5.0-rc71 (tag v0.5.0-rc71) and 0.6.0-rc159 (tag v0.6.0-rc159).

Workarounds

upgrade; turn off enable_jwe_encryption and rely on the JARM JWT signature alone if upgrading is not possible. Credits: none (the issue was reported publicly as #99 on 2026-10-03).