LeakyCreds
NewInstant webhook alerts now available — notified within seconds of any credential detection.Learn more →
Home / Vulnerability Intelligence / CVE-2026-35039

CVE-2026-35039 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: April 6, 2026

fast-jwt - Authentication Bypass

Published: April 6, 2026Updated: April 6, 2026Remote Exploitable

Overview

fast-jwt < 6.1.0 contains an authentication bypass caused by improper cacheKeyBuilder method leading to cache collisions, letting attackers cause token misidentification and user impersonation, exploit requires custom cacheKeyBuilder usage.

Severity & Score

Severity: Critical
CVSS Score: 9.1

Impact

Attackers can cause token misidentification, leading to user impersonation and unauthorized access to other users' claims.

Mitigation

Update to version 6.1.0 or later.

Details

CVE ID
CVE-2026-35039
Severity
Critical
CVSS Score
9.1
Type
broken_authentication
Status
new

CWE

  • CWE-345

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N