CVE-2026-91187

score

<0.1

cvss

—

epss

0.3%

published

2026-09-24

kev added

—

first seen

2026-10-21

dashbit nimble_zta >= 0.1.2 < 0.1.3 contains an improper verification of cryptographic signature caused by incorrect handling of JOSE.JWT.verify/2 result in verify_token/2, letting unauthenticated remote attackers authenticate as arbitrary Cloudflare service tokens, exploit requires sending a forged JWT with expected claims.