CVE-2024-33531: Cdbattags Lua Resty Jwt

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM.

Affected products

• Cdbattags Lua Resty Jwt: version 0.2.3 only

Published 2024-04-24. Last modified 2026-06-17.