CVE-2026-33746: Lcobucci Jwt Validate Without Signedwith
JWT validation via lcobucci/jwt does not include a `SignedWith` constraint. Only time-based or other non-cryptographic constraints are passed to `validator()->validate()` / `validator()->assert()`, so the token's cryptographic signature is never verified. An attacker can forge or tamper with the JWT payload (e.g. impersonate any user via a `user_uuid` claim)
greprules fetch cve-2026-33746-lcobucci-jwt-validate-without-signedwith --engine opengrepDescription
JWT validation via lcobucci/jwt does not include a `SignedWith` constraint. Only time-based or other non-cryptographic constraints are passed to `validator()->validate()` / `validator()->assert()`, so the token's cryptographic signature is never verified. An attacker can forge or tamper with the JWT payload (e.g. impersonate any user via a `user_uuid` claim)
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.