Quick answers
- Is CVE-2026-55735 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55735 being exploited in the wild.
- How severe is CVE-2026-55735?
- High severity, with a CVSS score of 7.5, published 1 August 2026.
- Which products and versions are affected?
- Erlang Ecosystem Foundation Guardian 1.0.0 before 2.4.1.
- Is there a fix for CVE-2026-55735?
- A patch was published on 2026-08-01: Fixed in version 2.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-55735 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-55735?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Guardian.revoke/3 in lib/guardian.ex uses peek/1 to decode JWT tokens, which performs only base64-decoding without cryptographic signature verification. Unlike sibling operations refresh/2 and exchange/4 that call decode_and_verify first, revoke/3 acts directly on unverified claims before passing them to the token module's revoke callback and on_revoke hook (state-mutating operations). An attacker can forge a JWT with known victim identifying claims (jti, sub), sign it with any key, and submit it to endpoints that call Guardian.revoke/3. When the token module mutates state keyed by these claims (e.g., whitelist deletion or blacklist insertion), the victim's legitimate session is evicted. The attack requires no authentication or knowledge of the signing secret. Versions before 2.4.1 are affected.
Affected products
- Erlang Ecosystem Foundation Guardian 1.0.0 before 2.4.1
Timeline
- 2026-08-01: disclosed
- 2026-08-01: patched: Fixed in version 2.4.1