{"id":"CVE-2026-19194","aliases":[],"cve":{"records":[{"id":"CVE-2026-19194","source":"HashiCorp","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-06T20:09:20.603Z","published":"2026-11-13T21:17:56.457Z","modified":"2026-11-13T21:30:34.534Z"}],"publishers":[{"name":"HashiCorp","role":"CNA","organizationId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","modified":"2026-11-13T21:17:56.457Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T21:30:34.534Z"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-60-cap-jwt-claims-validation-bypass-using-non-canonical-claim-names/78258","tags":[],"source":"HashiCorp"}],"weaknesses":[{"id":"CWE-178","description":"CWE-178: Improper Handling of Case Sensitivity","source":"HashiCorp"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T21:30:24.747414Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"CAP JWT claims validation bypass using non-canonical claim names","titleSource":"HashiCorp","descriptionSource":"HashiCorp","description":"The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0.","score":5.9,"severity":"medium","published":"2026-11-13T21:17:56.457Z","modified":"2026-11-13T21:30:34.534Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"HashiCorp","name":"Shared library","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"0","status":"affected","lessThan":"0.14.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-19194"}],"remediation":[],"references":["https://discuss.hashicorp.com/t/hcsec-2026-60-cap-jwt-claims-validation-bypass-using-non-canonical-claim-names/78258"],"sources":[{"name":"CVE","id":"CVE-2026-19194","modified":"2026-11-13T21:30:34.534Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-19194"}],"assessments":[{"source":"HashiCorp","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","score":5.9}],"sourceAffected":[],"observedAt":"2026-11-13T21:41:07.616Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:20:35.359Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-13T21:45:35.173Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-13T21:45:35.173Z","attemptedAt":"2026-11-13T21:45:35.173Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-13T21:45:35.173Z","attemptedAt":"2026-11-13T21:45:35.173Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T21:45:35.173Z","attemptedAt":"2026-11-13T21:45:35.173Z"}],"evidence":[],"aiSummary":{"text":"HashiCorp cap JWT validation library versions before 0.14.0 are vulnerable to a claims validation bypass, potentially causing incorrect authorization decisions. Exploitation requires attacker-controlled claims in a trusted JWT. The weakness is due to improper handling of case sensitivity.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T21:46:02.652Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-19194"}]}}