{"affected":[{"database_specific":{"last_known_affected_version_range":"<= 0.3.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vm9r-h74p-hg97/GHSA-vm9r-h74p-hg97.json"},"package":{"ecosystem":"Pub","name":"jose","purl":"pkg:pub/jose"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.3.5+1"}],"type":"ECOSYSTEM"}],"versions":["0.1.0","0.1.0+1","0.1.0+2","0.1.1","0.1.2","0.1.2+1","0.2.0","0.2.1","0.2.1+1","0.2.2","0.3.0","0.3.0-nullsafety.1","0.3.0-nullsafety.2","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5"]}],"aliases":["CVE-2026-34240"],"database_specific":{"cwe_ids":["CWE-347"],"github_reviewed":true,"github_reviewed_at":"2026-03-31T23:09:16Z","nvd_published_at":"2026-03-31T16:16:33Z","severity":"HIGH"},"details":"### Impact\n\nA vulnerability in `jose` versions up to and including `0.3.5` could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (`jwk`).  \n\nThe vulnerability exists because key selection could treat header-provided `jwk` as a verification candidate even when that key was not present in the trusted key store. Since JOSE headers are untrusted input, an attacker could exploit this by creating a token payload, embedding an attacker-controlled public key in the header, and signing with the matching private key.  \n\nApplications using affected versions for token verification are impacted.\n\n### Patches\n\nUpgrade to `0.3.5+1` or later.\n\n### Workarounds\n\nReject tokens where header `jwk` is present unless that `jwk` matches a key already present in the application's trusted key store.\n\n### Resources\n\nFix commit: [fix: improved key resolution in JsonWebKeyStore](https://github.com/appsup-dart/jose/commit/b07799aac1f56a9a21483feac026272aab30cc5d)","id":"GHSA-vm9r-h74p-hg97","modified":"2026-03-31T23:26:27.178816Z","published":"2026-03-31T23:09:16Z","references":[{"type":"WEB","url":"https://github.com/appsup-dart/jose/security/advisories/GHSA-vm9r-h74p-hg97"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34240"},{"type":"WEB","url":"https://github.com/appsup-dart/jose/commit/b07799aac1f56a9a21483feac026272aab30cc5d"},{"type":"PACKAGE","url":"https://github.com/appsup-dart/jose"}],"schema_version":"1.9.0","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"}],"summary":"jose vulnerable to untrusted JWK header key acceptance during signature verification"}