{"post_stream":{"posts":[{"id":148191,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png","created_at":"2026-11-13T21:16:59.112Z","cooked":"\u003cp\u003e\u003cstrong\u003eBulletin ID:\u003c/strong\u003e HCSEC-2026-60\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eAffected Products / Versions:\u003c/strong\u003e cap/jwt up to 0.13.0; fixed in 0.14.0.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003ePublication Date:\u003c/strong\u003e November 13, 2026\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eSummary\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eBackground\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe cap library provides JWT signature verification and claims validation for Go applications. Applications can configure expected issuer and subject values to constrain which tokens they accept before using the returned claims.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eDetails\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe library could interpret registered claims differently during validation and when returning them to the application. An attacker able to control token contents through a compromised or misconfigured trusted identity provider could potentially exploit this inconsistency to bypass configured issuer or subject expectations. The security impact depends on how the consuming application uses the returned claims. No unauthorized access has been demonstrated in Vault, Boundary, or other downstream applications. Applications that do not configure Expected.Subject or Expected.Issuer are not affected by the bypass of those respective checks.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eRemediation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eCustomers should evaluate the risk associated with this issue and consider upgrading their cap dependency to version 0.14.0 or later.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eAcknowledgement\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThis issue was reported to HashiCorp by anaximand3r and doyensec-mohamed.\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eWe deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see \u003ca href=\"https://hashicorp.com/security\"\u003ehttps://hashicorp.com/security\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e","post_number":1,"post_type":1,"posts_count":1,"updated_at":"2026-11-13T21:16:59.112Z","reply_count":0,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":9,"reads":1,"readers_count":0,"score":40.2,"yours":false,"topic_id":78258,"topic_slug":"hcsec-2026-60-cap-jwt-claims-validation-bypass-using-non-canonical-claim-names","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"link_counts":[{"url":"https://hashicorp.com/security","internal":false,"reflection":false,"clicks":0}],"read":true,"user_title":null,"bookmarked":false,"actions_summary":[],"moderator":true,"admin":false,"staff":true,"user_id":35937,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/hcsec-2026-60-cap-jwt-claims-validation-bypass-using-non-canonical-claim-names/78258/1","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null,"can_vote":false}],"stream":[148191]},"timeline_lookup":[[1,1]],"suggested_topics":[],"tags":[],"tags_descriptions":{},"fancy_title":"HCSEC-2026-60 - CAP JWT claims validation bypass using non-canonical claim names","id":78258,"title":"HCSEC-2026-60 - CAP JWT claims validation bypass using non-canonical claim names","posts_count":1,"created_at":"2026-11-13T21:16:59.029Z","views":37,"reply_count":0,"like_count":0,"last_posted_at":"2026-11-13T21:16:59.112Z","visible":true,"closed":false,"archived":false,"has_summary":false,"archetype":"regular","slug":"hcsec-2026-60-cap-jwt-claims-validation-bypass-using-non-canonical-claim-names","category_id":52,"word_count":279,"deleted_at":null,"user_id":35937,"featured_link":null,"pinned_globally":false,"pinned_at":null,"pinned_until":null,"image_url":null,"slow_mode_seconds":0,"draft":null,"draft_key":"topic_78258","draft_sequence":null,"unpinned":null,"pinned":false,"current_post_number":1,"highest_post_number":1,"deleted_by":null,"actions_summary":[{"id":4,"count":0,"hidden":false,"can_act":false},{"id":8,"count":0,"hidden":false,"can_act":false},{"id":10,"count":0,"hidden":false,"can_act":false},{"id":7,"count":0,"hidden":false,"can_act":false}],"chunk_size":20,"bookmarked":false,"topic_timer":null,"message_bus_last_id":228,"participant_count":1,"show_read_indicator":false,"thumbnails":null,"slow_mode_enabled_until":null,"board_memberships":[],"related_topics":[{"fancy_title":"HCSEC-2024-11 - Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims","id":67770,"title":"HCSEC-2024-11 - Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims","slug":"hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2024-06-12T18:47:55.351Z","last_posted_at":"2024-06-12T18:47:55.417Z","bumped":true,"bumped_at":"2024-06-12T19:00:20.871Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"like_count":0,"views":4108,"category_id":52,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":25501,"username":"mark.collao","avatar_template":"/user_avatar/discuss.hashicorp.com/mark.collao/{size}/23944_2.png","trust_level":1}}]},{"fancy_title":"HCSEC-2023-25 - Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers","id":57004,"title":"HCSEC-2023-25 - Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers","slug":"hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2023-08-08T21:02:10.874Z","last_posted_at":"2023-08-08T21:02:10.950Z","bumped":true,"bumped_at":"2023-08-10T16:17:43.157Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":74,"name":"security-consul","slug":"security-consul"}],"tags_descriptions":{},"like_count":0,"views":8080,"category_id":52,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":9164,"username":"eastebry","avatar_template":"/user_avatar/discuss.hashicorp.com/eastebry/{size}/13616_2.png","trust_level":1}}]},{"fancy_title":"Oidc json pointer not working for a custom claim where the key is a url","id":14709,"title":"Oidc json pointer not working for a custom claim where the key is a url","slug":"oidc-json-pointer-not-working-for-a-custom-claim-where-the-key-is-a-url","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2020-09-25T14:56:04.782Z","last_posted_at":"2020-09-28T09:26:10.763Z","bumped":true,"bumped_at":"2020-09-28T09:26:10.763Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"like_count":2,"views":712,"category_id":30,"featured_link":null,"op_like_count":2,"has_accepted_answer":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user":{"id":8073,"username":"jrluis","avatar_template":"/user_avatar/discuss.hashicorp.com/jrluis/{size}/12078_2.png","trust_level":1}},{"extras":null,"description":"Recent Poster","user":{"id":274,"username":"kalafut","avatar_template":"/user_avatar/discuss.hashicorp.com/kalafut/{size}/964_2.png","moderator":true,"trust_level":2}}]},{"fancy_title":"Please help me debug \u0026ldquo;claim iss is invalid\u0026rdquo;","id":27815,"title":"Please help me debug \"claim iss is invalid\"","slug":"please-help-me-debug-claim-iss-is-invalid","posts_count":12,"reply_count":7,"highest_post_number":12,"image_url":null,"created_at":"2021-08-05T06:59:15.339Z","last_posted_at":"2022-01-05T18:28:58.602Z","bumped":true,"bumped_at":"2022-01-05T18:28:58.602Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"like_count":0,"views":15823,"category_id":30,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user":{"id":15317,"username":"kahunacohen","avatar_template":"/user_avatar/discuss.hashicorp.com/kahunacohen/{size}/21336_2.png","trust_level":1}},{"extras":null,"description":"Frequent Poster","user":{"id":15479,"username":"milenauehara","avatar_template":"/user_avatar/discuss.hashicorp.com/milenauehara/{size}/16380_2.png","trust_level":1}},{"extras":null,"description":"Recent Poster","user":{"id":7130,"username":"tomhjp","avatar_template":"/user_avatar/discuss.hashicorp.com/tomhjp/{size}/10781_2.png","trust_level":2}},{"extras":"latest","description":"Most Recent Poster","user":{"id":2698,"username":"wsams","avatar_template":"/user_avatar/discuss.hashicorp.com/wsams/{size}/42185_2.png","trust_level":1}}]},{"fancy_title":"\u0026ldquo;audience claim found in JWT but no audiences bound to the role\u0026rdquo;","id":71119,"title":"\"audience claim found in JWT but no audiences bound to the role\"","slug":"audience-claim-found-in-jwt-but-no-audiences-bound-to-the-role","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2024-11-04T15:31:10.982Z","last_posted_at":"2024-11-10T22:36:26.249Z","bumped":true,"bumped_at":"2024-11-10T22:58:47.310Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"like_count":1,"views":1121,"category_id":31,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user":{"id":29479,"username":"ricardolopes86","avatar_template":"/user_avatar/discuss.hashicorp.com/ricardolopes86/{size}/36385_2.png","trust_level":1}},{"extras":"latest","description":"Most Recent Poster","user":{"id":37256,"username":"vincent31337","avatar_template":"/user_avatar/discuss.hashicorp.com/vincent31337/{size}/43100_2.png","trust_level":0}}]}],"summarizable":false,"has_cached_summary":false,"valid_reactions":["heart","+1","laughing","open_mouth","clap","confetti_ball","hugs"],"has_accepted_answer":false,"can_create_shared_issue":false,"shared_issue_visible":false,"can_vote":false,"vote_count":0,"user_voted":false,"details":{"can_edit":false,"notification_level":1,"participants":[{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"moderator":true,"trust_level":4}],"created_by":{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png"},"last_poster":{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png"}},"bookmarks":[]}