CVE-2026-55735
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Improper Verification of Cryptographic Signature in guardian (versions from 1.0.0 before 2.4.1) allows an unauthenticated attacker to revoke a victim's session with a forged JWT token.
Risk Assessment
An attacker can cause denial of service by revoking user sessions, leading to application disruption.
Recommendation
Update guardian to version 2.4.1 or later.
Other vulnerabilities in guardian
See all- CVE-2026-34116Critical
A vulnerability in the Guardian language system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the 'id' parameter in transcribe.php. The parameter is passed directly to the PHP exec() function without any sanitization.
- CVE-2026-34114Critical
The vulnerability in the Guardian language system involves passing the 'id' GET parameter directly into a PHP exec() call in translate_text.php without sanitization. No authentication is required, allowing an unauthenticated remote attacker to execute arbitrary OS commands.
- CVE-2026-34113Critical
A vulnerability in the Guardian language-system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the id parameter in speech_text.php.
- CVE-2026-34109Critical
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' GET parameter passed directly to the PHP exec() function in speech.php.
- CVE-2026-34108Critical
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the id parameter, which is passed unsanitized to the exec() function in text.php.
- CVE-2026-34106Critical
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' parameter in subtitles.php. The parameter is passed directly to the PHP exec() function without any sanitization.
- CVE-2026-55734High
A vulnerability in the Guardian library (Guardian.Permissions module) allows a denial of service attack via BEAM atom-table exhaustion. The encode_permissions!/1 function converts map keys to atoms without validation, and atoms are never garbage collected, exhausting the fixed-size atom table.
- CVE-2026-55733High
A vulnerability in the Guardian library (Elixir) allows DoS via unbounded atom creation from attacker-controlled binary input. The encode/3 function in Guardian.Permissions.AtomEncoding calls String.to_atom/1 without validation, exhausting the BEAM atom table and crashing the node.
- CVE-2026-54894High
Allocation of Resources Without Limits or Throttling in guardian (versions from 0.1.0 before 2.4.1) allows denial of service via unbounded atom creation from attacker-influenced binary input.
Original NVD description (English source)
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.