The NeuVector JWT verifier does not enforce canonical Base64URL encoding for the RSA signature field, allowing an attacker holding a valid, non‑expired token to replace the signature bytes with an equivalent but differently encoded version. This flaw lets a user who has logged out of NeuVector continue to use the same token until it expires, effectively bypassing the logout mechanism. The underlying weakness is a failure to validate cryptographic data properly.

The vulnerability affects the NeuVector platform. No specific product versions are listed in the advisory; users should check for any available updates or patches from the vendor.

The CVSS v3.1 score is 2, indicating low severity. The EPSS score is below 1%, and the vulnerability is not currently catalogued in CISA KEV. What matters in practice is that an attacker who has already obtained a valid token before logout can reuse it, providing a persistence or credential replay vector until the token’s natural expiration.