The vulnerability resides in the VerifyHostToken function of Netmaker’s logic/jwts.go, where the JWT signature is not validated when verifying host tokens. An attacker can forge a token signed with any arbitrary key and use it to impersonate any host within the network, gaining access to sensitive information and potentially other services. This flaw aligns with CWE-347, involving the use of invalid signing keys, and the issue enables a direct authentication bypass for host identities.

All Netmaker installations running versions prior to 1.5.0 are impacted. This includes both community and commercial distributions that rely on JWT tokens for host authentication in software‑defined networking and VPN environments.

The likely attack vector is network-based, as forged tokens can be inserted into API traffic between hosts. The data indicates no EPSS score and no inclusion in the CISA KEV catalog. A CVSS score of 8.2 reflects a medium‑high severity authentication bypass, threatening confidentiality and integrity across the network.