Bulletin ID: HCSEC-2026-60
Affected Products / Versions: cap/jwt up to 0.13.0; fixed in 0.14.0.
Publication Date: November 13, 2026
Summary
The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0.
Background
The cap library provides JWT signature verification and claims validation for Go applications. Applications can configure expected issuer and subject values to constrain which tokens they accept before using the returned claims.
Details
The library could interpret registered claims differently during validation and when returning them to the application. An attacker able to control token contents through a compromised or misconfigured trusted identity provider could potentially exploit this inconsistency to bypass configured issuer or subject expectations. The security impact depends on how the consuming application uses the returned claims. No unauthorized access has been demonstrated in Vault, Boundary, or other downstream applications. Applications that do not configure Expected.Subject or Expected.Issuer are not affected by the bypass of those respective checks.
Remediation
Customers should evaluate the risk associated with this issue and consider upgrading their cap dependency to version 0.14.0 or later.
Acknowledgement
This issue was reported to HashiCorp by anaximand3r and doyensec-mohamed.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.