The vulnerability exists in @fastify/jwt versions prior to 10.2.2. When an application calls request.jwtVerify({ key }) with a per‑request key, the library mistakenly overrides that key with the globally configured secret during option merging. This flaw allows a token signed with the global secret to be accepted on any route that explicitly requires a different key, enabling an authenticated user to cross a key‑based trust boundary without knowledge of any secret. The flaw constitutes an authorization bypass.

The affected product is the @fastify/jwt JSON Web Token plugin for the Fastify web framework. Versions before 10.2.2 are vulnerable. Applications that configure multiple key domains—such as separate user and admin tokens—are at risk. The issue is fixed in version 10.2.2 and later.

The CVSS base score of 8.1 indicates a high severity. EPSS is not available, so the current exploitation probability is unknown, but the lack of an entry in the CISA KEV catalog suggests no widespread active exploitation has been reported. The likely attack vector is remote, via the supply of a crafted JWT to a protected route. An attacker who is already authenticated and can produce a valid token using the global secret can impersonate users in tighter privilege domains. Successful exploitation would provide elevated privileges and unauthorized access to protected resources.