Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.

verifytoken/2 in lib/nimblezta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {, token, s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verifyiss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.

This issue affects nimblezta: from 0.1.2 before 0.1.3.