fast-jwt allows creation of verifiers that accept unsigned JWTs when the signing key is an empty string or null and an explicit algorithm list is provided. The bypass permits an attacker to include arbitrary claims in a token without possessing a signing key, leading to unauthorized access or privilege escalation. The flaw is rooted in improper input validation and failure to enforce signature checks (CWE-20, CWE-347).

any deployment of the nearform fast-jwt library before version 6.3.1 is affected. The issue is addressed in the 6.3.1 release and newer. If an application relies on older versions and does not enforce signed tokens, it remains vulnerable.

The CVSS score of 7.4 indicates high severity. EPSS is not available, but the vulnerability is not yet listed in the KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is over any network channel that delivers tokens to the verifier, such as HTTP or other IPC mechanisms – this is inferred from the description, which states that an attacker can submit a token containing arbitrary claims. The attack does not require privileged knowledge of a secret key, making it straightforward for malicious actors to subvert authentication or authorization.