Type confusion in the Rust JWT library allows an attacker to craft a JWT that contains standard claims such as "nbf" or "exp" with an incorrect JSON type, causing the parser to mark the claim as "FailedToParse" and treat it as if the claim were not present. Because the validation logic treats a failed parse identically to a missing claim and because the claim is not marked as required in "required_spec_claims", the library skips validation, permitting the attacker to bypass time‑based restrictions. This flaw can enable authentication or authorization circumvention without the proper credential checks.

The vulnerability affects all versions of Keats' "jsonwebtoken" Rust library older than 10.3.0. Any application, service, or component that links against this library for JWT validation is potentially exposed, regardless of operating system or deployment environment, as long as the vulnerable version is in use.

The flaw carries a CVSS score of 5.5 and an EPSS of less than 1%, reflecting moderate severity and a low probability of real‑world exploitation. Attackers can enact the vulnerability by supplying a maliciously crafted JWT to any application endpoint that performs token validation—such as web APIs or authentication middleware—provided they can influence the token payload. The requirement to forge a JWT with the wrong claim type limits the attack to contexts where the attacker has control over token creation or possesses the signing key, thereby bounding risk to systems that issue or process tokens from untrusted sources.