CVE-2026-78426 — Logout bypass via alternate JWT spelling
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of …
Published: 2026-09-17 · CVSS: 2.0 · CVSS 4.0
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7