CVE-2025-30064: JWT Authentication Bypass Vulnerability

CVE-2025-30064 Overview

CVE-2025-30064 is an authentication bypass vulnerability caused by improper JSON Web Token (JWT) signature verification [CWE-347]. The decodeParam function validates the JWT but does not verify which signing algorithm was used. An attacker can supply the ex:action parameter to the VerifyUserByThrustedService function to generate a valid session for any user. The flaw enables full impersonation of arbitrary accounts, including privileged users, without possessing their credentials.

Critical Impact
An authenticated local attacker can forge sessions for arbitrary users, resulting in high impact to confidentiality, integrity, and availability across affected systems.

Affected Products

Product details not disclosed in the public advisory
See the CERT-PL CVE-2025-2313 Analysis for related technical context
Refer to vendor advisories for specific affected versions

Discovery Timeline

2025-08-27 - CVE-2025-30064 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30064

Vulnerability Analysis

The vulnerability resides in the decodeParam function, which processes incoming JWTs during authentication. The function verifies the token signature but fails to enforce the expected signing algorithm. This class of flaw is commonly referred to as a JWT algorithm confusion attack. An attacker can craft a token that specifies a weaker or attacker-controlled algorithm, such as none or an asymmetric-to-symmetric swap, and pass validation.

The downstream VerifyUserByThrustedService function consumes the ex:action parameter from the decoded payload. Because the parent decoder trusts the token, the service treats the supplied identity as authentic. The attacker then obtains a session bound to any user identifier they specify.

Root Cause

The root cause is improper verification of a cryptographic signature [CWE-347]. Secure JWT libraries require the verifier to pin an allow-list of signing algorithms independent of the token header. The affected implementation instead trusts the alg claim inside the token, allowing an attacker to select an algorithm the verifier will accept without possessing the true signing key.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attacker submits a forged JWT to an endpoint that reaches decodeParam, then triggers VerifyUserByThrustedService with a chosen ex:action value. Successful exploitation returns an authenticated session as the targeted user. Because the attack targets internal trust boundaries, the compromised session inherits the full permissions of the impersonated account.

No public proof-of-concept exploit code was available at time of writing. Refer to the CERT-PL analysis for additional technical detail on the underlying JWT verification flaw.

Detection Methods for CVE-2025-30064

Indicators of Compromise

JWTs presented to the application with alg header values of none, HS256 where RS256 is expected, or other unexpected algorithm identifiers
Session creation events for user accounts without corresponding successful password or MFA authentication events
Requests containing the ex:action parameter directed at the VerifyUserByThrustedService endpoint from unusual source contexts
Authentication log entries showing session issuance immediately following calls to decodeParam without prior credential validation

Detection Strategies

Inspect application authentication logs for JWTs whose alg header deviates from the documented, expected algorithm
Correlate session issuance events with the presence of preceding user login events. Sessions without a matching login are candidates for investigation
Alert on any invocation of internal trust functions such as VerifyUserByThrustedService originating from user-facing request paths

Monitoring Recommendations

Enable verbose logging on JWT parsing and rejection paths, capturing the alg, kid, and subject claims
Forward authentication and session telemetry to a centralized SIEM for cross-source correlation
Baseline normal ex:action parameter values and alert on deviations or high-volume submissions from a single principal

How to Mitigate CVE-2025-30064

Immediate Actions Required

Apply the vendor-supplied security update as soon as it is available for your deployment
Restrict local access to the affected system to trusted administrators until patching is complete
Invalidate all existing sessions and force re-authentication after patching to evict any forged sessions
Rotate JWT signing keys to invalidate tokens that may have been forged using the algorithm confusion technique

Patch Information

Refer to the CERT-PL advisory and the vendor's security bulletin for patch availability and version guidance. Vendor and product identifiers were not published to NVD at the time of writing.

Workarounds

Configure the JWT verification layer to pin an explicit allow-list of signing algorithms and reject tokens whose alg header does not match
Reject any inbound JWT with an alg value of none
Where feasible, block or filter requests containing the ex:action parameter at a reverse proxy or web application firewall until the patch is applied
Enforce least privilege on local accounts to limit the blast radius of a forged session

bash

# Example: reject tokens with unexpected algorithms at a reverse proxy
# (adapt to your gateway; conceptual illustration only)
if ($http_authorization ~* "eyJ[A-Za-z0-9_-]+\.") {
    # Decode header and drop requests where alg != RS256
    access_by_lua_block {
        local jwt_header = require("jwt_header_check")
        if not jwt_header.alg_is("RS256") then
            ngx.exit(401)
        end
    }
}