CVE-2026-55165

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.0 Lemur version 1.9.0

Description The JWT verifier in the lemur/lemur/auth/service.py component trusts the alg header field from unverified tokens and passes it directly into the pyjwt.decode() function via the algorithms parameter. This implementation allows an attacker to specify which signing algorithm the server should trust, rather than the server enforcing a pinned allowlist.

While PyJWT 2.x prevents a direct account takeover (ATO) by rejecting alg=none, this flaw creates a defense-in-depth gap. If the system migrates to asymmetric signing (e.g., RS256), an attacker could use the public key as an HMAC secret by pinning alg=HS256. Additionally, this allows attackers to blind anomaly detection in audit logs by manipulating the alg value. If the LEMUR TOKEN SECRET variable is disclosed through a separate vulnerability, an attacker can forge administrative tokens to issue, revoke, or exfiltrate certificates.

Recommendations For Lemur versions prior to 1.9.0 and version 1.9.0, implement a server-side pin for accepted algorithms by replacing the attacker-controlled alg input with a fixed list from the application configuration, such as current app.config.get("JWT ALGORITHMS", ["HS256"]). Log the algorithm actually applied by the server separately from the one claimed in the token header to detect mismatches. Restrict the algorithms list to the smallest possible set of required algorithms. Migrate to asymmetric signing (RS256) with key rotation to prevent token forgery in the event of a secret disclosure.