Wiz Vulnerability Database CVE-2026-25537 CVE-2026-25537 : Rust vulnerability analysis and mitigation jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks the claim as “FailedToParse”. Crucially, the validation logic treats this “FailedToParse” state identically to “NotPresent”. This means that if a check is enabled (like: validate_nbf = true), but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim, treating it as if it were not there. This allows attackers to bypass critical time-based security restrictions (like “Not Before” checks) and commit potential authentication and authorization bypasses. This issue has been patched in version 10.3.0. Source : NVD Related Rust vulnerabilities: CVE ID Severity Score Technologies Component name CISA KEV exploit Has fix Published date CVE-2026-25628 HIGH 8.5 Rust qdrant No Yes Feb 06, 2026 GHSA-x468-phr8-h3p3 CRITICAL N/A Rust uniswap-utils No No Feb 06, 2026 GHSA-f8h5-x737-x4xr CRITICAL N/A Rust finch-rust No No Feb 06, 2026 GHSA-3mmg-7c2q-8938 CRITICAL N/A Rust sha-rust No No Feb 06, 2026 GHSA-382q-fpqh-29f7 CRITICAL N/A Rust polymarket-clients-sdk No No Feb 06, 2026 Free Vulnerability Assessment Benchmark your Cloud Security Posture Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses. Request assessment Additional Wiz resources Cloud Vulnerability DB A community-led vulnerabilities database Cloud Threat Landscape A threat intelligence database PEACH A tenant isolation framework Get a personalized demo Ready to see Wiz in action? "Best User Experience I have ever seen, provides full visibility to cloud workloads." David Estlick CISO "Wiz provides a single pane of glass to see what is going on in our cloud environments." Adam Fletcher Chief Security Officer "We know that if Wiz identifies something as critical, it actually is." Greg Poniatowski Head of Threat and Vulnerability Management Get a demo