The vulnerability allows an unauthenticated attacker to create a valid JSON Web Token (JWS) or JSON Web Token (JWT) by embedding an attacker‑controlled public key in the token header (jwk). During verification, the library may mistakenly use this header key even if it is not part of the trusted key store. An attacker can sign the token with the corresponding private key, tricking applications into treating the token as authentic. This weakness can lead to privilege escalation or unauthorized access and is classified as CWE-347. The impact is the loss of authentication integrity for any application that relies on the affected version for token validation.

The affected product is the jose library supplied by appsup-dart, versions prior to 0.3.5+1. Applications integrating this library for JWS/JWT verification are impacted and should ensure they use the patched version or a compatible alternative.

The CVSS score is 7.5, indicating a medium‑to‑high severity. Since EPSS data is not available and the issue is not listed in the KEV catalog, the overall risk is still significant, especially in environments where JWTs govern access control. The likely attack vector is remote: an attacker can transmit a crafted token over any network channel used by the application. If the application accepts the forged token, the attacker gains the same privileges as the token’s intended bearer. Even with a patch, failure to validate the presence of the header key against a trusted store can allow exploitation. As such, the vulnerability is highly actionable and demands swift remediation.