Guardian.revoke/3 in the ueberauth Guardian library ignores cryptographic signature verification when decoding a supplied token. The unverified claims are passed directly to the token module’s revoke logic, allowing an attacker to craft a forged JWT containing a victim’s identifying claims (such as jti or sub), sign it with any key, and invoke the revocation endpoint. The victim’s legitimate session is then removed, resulting in an unauthenticated denial‑of‑service attack on session continuity. This weakness is a classic Improper Verification of Cryptographic Signature (CWE‑347).

The vulnerability applies to the Guardian authentication library from ueberauth, affecting all releases from version 1.0.0 up to but not including 2.4.1. The fix was incorporated in Guardian 2.4.1 and newer releases.

The CVSS score of 8.2 denotes high severity, while the EPSS score of less than 1% indicates a very low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by sending an unauthenticated HTTP request that carries a forged token to any endpoint that forwards the caller‑supplied token into Guardian.revoke/3, such as the standard logout route. Because token claim values are often predictable or guessable, the attack has a modest discovery cost but does not require the signing secret.