Executive brief
SmallRye JWT is a library used by Java applications to verify digitally signed authentication tokens from AWS load balancers. A flaw in its AWS key resolver allows attackers to craft malicious tokens that force the application to fetch data from arbitrary paths within its internal network, potentially exposing sensitive configuration, credentials, or internal APIs before the token's authenticity is even checked.
Technical details
A path traversal vulnerability exists in SmallRye JWT's AwsAlbKeyResolver component when configured with the AWS_ALB key provider. The resolver constructs a URL to fetch JWT signing keys by concatenating the attacker-controlled "kid" (key ID) header value from an inbound JWT without sanitizing path traversal characters (e.g., "../") or query-string separators. This allows an unauthenticated remote attacker to craft a JWT with a malicious kid value that forces the application to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. The vulnerability is pre-authentication—the attacker does not need a valid JWT or credentials, and the server fetches the attacker-specified URL before verifying the token's signature. An attacker can thus read non-public endpoints, configuration files, or other internal data reachable on that origin.
Affected products
- SmallRye JWT <UNKNOWN>
Timeline
- 2026-09-17: disclosed