important · Zero-click — Identity
A forged JWT can impersonate a Cloudflare service token in nimble_zta 0.1.2.
Affects
nimble_zta, an Elixir authentication library used by Phoenix and Plug server applications behind Cloudflare Zero Trust.
The library discarded JOSE’s signature-verification verdict and returned decoded claims even after verification failed.
Detail and 2 sources
The public fix requires a true verdict and adds a failed-signature regression test.