CVE-2026-55165: Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
| Field | Value |
|---|---|
| Title | Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure |
| Component | lemur/lemur/auth/service.py:130-137 |
| CWE | CWE-347 (Improper Verification of Cryptographic Signature) |
| Attack Prerequisite | Defense-in-depth gap on its own — no single-request exploit against PyJWT 2.x. Single-request ATO requires a separate disclosure issue that leaks LEMUR_TOKEN_SECRET, or a future migration to asymmetric signing without fixing this sink. |
| Affected Versions | github.com/Netflix/lemur version = “1.9.0”. Same code present in every prior release that has the auth/service.py:130 block. |
References
Code Behaviors & Features
Detect and mitigate CVE-2026-55165 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →