GitHub Advisoryadvisory · Maven

GHSA-5pq9-5mpr-jj85 Jervis Has a JWT Algorithm Confusion Vulnerability

MEDIUM Published 2026-01-13 Modified 2026-01-21 Official page ↗
Aliases
CVE-2025-68925
Ecosystem
Maven
Packages
net.gleske:jervis
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-347
Reviewed
2026-01-13

Affected packages

• Maven net.gleske:jervis: < 2.2 → fixed in 2.2

Description

Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249 The code doesn't validate that the JWT header specifies `"alg":"RS256"`. Impact Depending on the broader system, this could allow JWT forgery. Internally this severity is low since JWT is only intended to interface with GitHub. External users should consider severity moderate. Patches Jervis patch will explicitly verify the algorithm in the header matches expectations and further verify the JWT structure. Upgrade to Jervis 2.2. Workarounds External users should consider using an alternate JWT library or upgrade. References • RFC 7518: JSON Web Algorithms

Related

Alias · CVE (1)

  • CVE-2025-68925 Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References