CVE-2024-25189: Debian Linux
Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Affected products
Published 2024-02-08. Last modified 2026-06-17.