A SQL injection flaw in the auth_jwt module allows an attacker to insert malicious content into the tag claim of a JSON Web Token (JWT). Because the module does not verify the token’s signature before using the claim, the unescaped value is embedded directly into a SQL statement against the authentication database. This enables the attacker to manipulate the query and force the authentication routine to accept the token, thereby bypassing normal authentication controls and allowing impersonation of any user.

OpenSIPS server software, versions 3.1 up to and including 3.6.4, when the auth_jwt module is enabled with db_mode and a relational database backend. The vulnerability exists in all releases before the commit that fixes the issue.

The CVSS score of 8.3 indicates high severity, but the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires only the ability to send a crafted JWT to the OpenSIPS instance, implying a remote capability that makes it potentially exploitable over the network, especially where JWTs are accepted without signature validation.