CVE-2026-19194: Medium severity vulnerability

Published Nov 13, 2026

Updated

The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.14.0

Event History

Nov 13, 2026

CVE Published

via NVD·10:17 PM

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Applications using the HashiCorp cap JWT validation library before 0.14.0 are exposed if they trust JWTs that can contain attacker-controlled claims. The risk is in downstream authorization decisions that consume claim values after validation.

What does an attacker need to exploit it?

An attacker needs a JWT signed by a key trusted by the application and control over claims in that JWT. The attack complexity is high, and no user interaction is required.

What should teams do to remediate the issue?

Upgrade the HashiCorp cap JWT validation library to version 0.14.0. This version fixes the claims validation bypass.

How can teams determine whether they may be affected?

Identify deployments using cap versions earlier than 0.14.0, then review whether the application authorizes users based on JWT claims. Prioritize cases where trusted JWT issuers permit attacker-controlled claim content.

CVE-2026-19194: Medium severity vulnerability

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What should teams do to remediate the issue?

How can teams determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What should teams do to remediate the issue?

How can teams determine whether they may be affected?