Description
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.

verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.

This issue affects nimble_zta: from 0.1.2 before 0.1.3.
Published: 2026-09-24
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass via forged JWT
Action: Apply Patch
AI Analysis

Impact

An unauthenticated remote attacker can forge a JWT that contains valid Cloudflare service token claims. The NimbleZTA.Cloudflare.verify_token/2 function mistakenly ignores the boolean result of JOSE.JWT.verify/2 and returns the decoded token even when the signature verification fails. Consequently, an attacker can supply a crafted cf-access-jwt-assertion header, pass the issuer check, and have NimbleZTA consider the forged token as a legitimate service identity.

Affected Systems

The flaw exists in dashbit nimble_zta versions prior to 0.1.3, specifically 0.1.2 and earlier releases. Any deployment using those versions with the Cloudflare Zero Trust authentication strategy is at risk.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.3, indicating critical severity. While the EPSS score is not available, the high CVSS and the fact that exploitation only requires an HTTP request with a forged header suggest that it could be actively exploited. The issue is not currently listed in the CISA KEV catalog, but its impact remains significant.

Generated by OpenCVE AI on September 25, 2026 at 01:36 UTC.

Remediation

Vendor Workaround

Disable the Cloudflare authentication strategy. To keep the user identity strategy available, reject the service token requests yourself. Examine each request before you call NimbleZTA.Cloudflare.authenticate/3, and reject it if its JWT carries the common_name claim and the type claim.

OpenCVE Recommended Actions

  • Upgrade nimble_zta to version 0.1.3 or later which properly validates JWT signatures.
  • If an upgrade is not immediately possible, disable the Cloudflare authentication strategy entirely to eliminate the vulnerable path.
  • Temporarily filter incoming requests by inspecting the cf-access-jwt-assertion header; reject any JWT that carries a common_name claim and the type claim before calling NimbleZTA.Cloudflare.authenticate/3.

Generated by OpenCVE AI on September 25, 2026 at 01:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity. This issue affects nimble_zta: from 0.1.2 before 0.1.3.
Title Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy
First Time appeared Dashbit
Dashbit nimble Zta
Weaknesses CWE-347
CPEs cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*
Vendors & Products Dashbit
Dashbit nimble Zta
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Dashbit Nimble Zta
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-24T14:47:30.520Z

Reserved: 2026-09-15T15:30:01.892Z

Link: CVE-2026-91187

cve-icon Vulnrichment

Updated: 2026-09-24T14:43:10.349Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T14:18:18.667

Modified: 2026-09-24T19:39:45.600

Link: CVE-2026-91187

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T14:17:43Z

Weaknesses
  • CWE-347

    Improper Verification of Cryptographic Signature