CVE-2026-91187: Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy
Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.
verifytoken/2 in lib/nimblezta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {, token, s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verifyiss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.
This issue affects nimblezta: from 0.1.2 before 0.1.3.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using nimble_zta's Cloudflare Zero Trust authentication strategy are affected. The vulnerable versions are 0.1.2 up to, but not including, 0.1.3.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker needs to send a forged JWT in the cf-access-jwt-assertion header. The forged token must include the expected iss claim and the seven service-token claims.
What access can successful exploitation provide?
The attacker can authenticate as an arbitrary Cloudflare service token. The vulnerable verification path returns claims from the forged token as the authenticated identity after a failed signature check.
How can I identify vulnerable code or active exploitation attempts?
Check whether the application uses the Cloudflare strategy and runs nimble_zta version 0.1.2 or a version before 0.1.3. Requests containing cf-access-jwt-assertion JWTs should be treated as relevant to this authentication path.