This vulnerability is only exploitable when AES-GCM is handled by the pure-Erlang jose_jwa_aes fallback. That fallback is used on deployments where the Erlang/OTP crypto NIF does not expose native AES-GCM (for example FIPS builds, or stripped or older OTP releases). Deployments with a native AES-GCM crypto provider dispatch GCM through crypto and are not affected.
The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds.
This issue affects jose: from 1.2.0 before 1.11.13.
" }, { "base64": false, "type": "text/markdown", "value": "The pure-Erlang AES-GCM fallback in `jose_jwa_aes` derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the `{aes_gcm, Bits}` clause of `block_decrypt/4`, the incoming tag is guarded only by `is_binary/1`, with no check on its length. Verification in `gcm_block_decrypt/6` then computes `TBits = bit_size(T)` and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds.\n\nThis issue affects jose: from 1.2.0 before 1.11.13." } ], "value": "The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds.\n\nThis issue affects jose: from 1.2.0 before 1.11.13." } ], "impacts": [ { "capecId": "CAPEC-475", "descriptions": [ { "lang": "en", "value": "CAPEC-475 Signature Spoofing by Improper Validation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 5.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-354", "description": "CWE-354 Improper Validation of Integrity Check Value", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-26T19:52:54.987Z" }, "references": [ { "tags": [ "vendor-advisory", "related" ], "url": "https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-6gxw-6f7r-cjr6" }, { "name": "EEF CNA record for CVE-2026-65625", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-65625.html" }, { "name": "OSV record EEF-CVE-2026-65625", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-65625" }, { "name": "Introducing commit 8848b17 in potatosalad/erlang-jose", "tags": [ "related" ], "url": "https://github.com/potatosalad/erlang-jose/commit/8848b172575fb7d7e1e2977e8ae0a21678d2157a" }, { "name": "Fix commit 3fa1f8e in potatosalad/erlang-jose", "tags": [ "patch" ], "url": "https://github.com/potatosalad/erlang-jose/commit/3fa1f8e3efda0da5ce6f4c9984789f979dc02740" } ], "source": { "discovery": "EXTERNAL" }, "title": "Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Ensure the runtime provides a crypto provider with native AES-GCM support (a standard Erlang/OTP build linked against OpenSSL) so that JOSE dispatches AES-GCM to the native crypto NIF instead of the jose_jwa_aes fallback.