Executive brief
NeuVector is a container security platform that uses JWT tokens to authenticate users and maintain sessions. A flaw in its JWT signature verification allows an attacker with a valid but logged-out token to continue using the token by modifying its Base64URL encoding, effectively bypassing logout controls and extending unauthorized access until the token naturally expires.
Technical details
The vulnerability is an authentication bypass due to improper JWT signature validation. The NeuVector JWT verifier accepts multiple noncanonical (non-unique) Base64URL encodings of the same RSA signature field, allowing an attacker to craft alternative valid encodings of a logged-out token. An attacker with a valid, non-expired JWT that has been logged out can re-encode the signature and continue authenticated requests. The attack requires the attacker to hold a previously-valid token and user interaction to obtain it, but works across the network. Patches are available in NeuVector v5.6.2, v5.5.4, v5.4.11 and later, which enforce unique compact JWT serialization.
Affected products
- NeuVector NeuVector <=5.6.1
Timeline
- 2026-09-16: disclosed
- 2026-09-17: patched: Patched in v5.6.2, v5.5.4, v5.4.11 and later