The Guardicore Platform Agent on all platforms before version 7.4 does not properly validate JSON Web Tokens that are supplied during seeding, a CWE‑99 weakness involving improper validation. By luring a user to a malicious URL that contains a forged token, an attacker can cause the agent to accept that token and inject arbitrary configuration parameters. These injected parameters can alter the agent’s behavior or trigger privileged operations, effectively giving the attacker full control over the client’s functionality.

Akamai Guardicore Platform Agent, all supported operating systems, any installation running a version earlier than 7.4. The issue applies to clients that were seeded through a user‑enrollment process or to any pre‑seeded client where the attacker knows the identity‑provider URL.

The flaw carries a CVSS score of 8.5 and an EPSS of less than 1 %, indicating high severity but a low likelihood of exploitation. It is not listed in CISA’s KEV catalog. Attack execution requires the victim to click a malicious link or the attacker to know the IDP URL of a seeded client; no additional network privileges are necessary. Once the spoofed token is delivered, it applies the malicious configuration, resulting in a complete compromise of the application’s integrity and confidentiality.