# CVE-2026-78426: NeuVector JWT verifier accepts noncanonical Base64URL encodings

Source: https://junglewise.ai/threats/cve-2026-78426-neuvector-jwt-verifier-accepts-noncanonical-base64url-encodings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78426 · Severity: low · CVSS 3.7 · Published 2026-09-17

NeuVector is a container security platform that uses JWT tokens to authenticate users and maintain sessions. A flaw in its JWT signature verification allows an attacker with a valid but logged-out token to continue using the token by modifying its Base64URL encoding, effectively bypassing logout controls and extending unauthorized access until the token naturally expires.

## Quick answers

**Is CVE-2026-78426 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78426 being exploited in the wild.

**How severe is CVE-2026-78426?** Low severity, with a CVSS score of 3.7, published 17 September 2026.

**Which products and versions are affected?** NeuVector NeuVector <=5.6.1.

**Is there a fix for CVE-2026-78426?** A patch was published on 2026-09-17: Patched in v5.6.2, v5.5.4, v5.4.11 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78426 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78426?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass due to improper JWT signature validation. The NeuVector JWT verifier accepts multiple noncanonical (non-unique) Base64URL encodings of the same RSA signature field, allowing an attacker to craft alternative valid encodings of a logged-out token. An attacker with a valid, non-expired JWT that has been logged out can re-encode the signature and continue authenticated requests. The attack requires the attacker to hold a previously-valid token and user interaction to obtain it, but works across the network. Patches are available in NeuVector v5.6.2, v5.5.4, v5.4.11 and later, which enforce unique compact JWT serialization.

## Affected products

- NeuVector NeuVector <=5.6.1

## Timeline

- 2026-09-16: disclosed
- 2026-09-17: patched: Patched in v5.6.2, v5.5.4, v5.4.11 and later

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-78426](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-78426)
- [https://github.com/neuvector/neuvector/security/advisories/GHSA-wcx5-mq6c-c54j](https://github.com/neuvector/neuvector/security/advisories/GHSA-wcx5-mq6c-c54j)