{"id":"CVE-2026-19194","kind":"vulnerability","aliases":["CVE-2026-19194"],"related":[],"title":"HashiCorp cap JWT library: claim validation bypass lets attackers pass authorization checks","description":"The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0.","summary":"The HashiCorp cap JWT validation library before 0.14.0 can validate one claim while downstream code authorizes using a different value, via non-canonical claim names. An attacker holding a JWT signed by a trusted key can use attacker-controlled claims to get unauthorized access.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","hashicorp-cap","jwt","package"],"not_affected_if":["cap-not-used","jwt-not-validated-by-cap"],"how_to_check":"- Check the cap version your Go module uses, for example with `go list -m github.com/hashicorp/cap`\n- Look for `github.com/hashicorp/cap` in `go.mod` and `go.sum`","fix":"- cap `0.14.0`","status":"open","published_at":"2026-11-13T22:17:25+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:37+00:00","updated_at":"2026-11-13T22:34:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T22:34:37Z","model":"claude-haiku-5-5","output":{"fix":"- cap `0.14.0`","reach":"network","title":"HashiCorp cap JWT library: claim validation bypass lets attackers pass authorization checks","impact":"high","summary":"The HashiCorp cap JWT validation library before 0.14.0 can validate one claim while downstream code authorizes using a different value, via non-canonical claim names. An attacker holding a JWT signed by a trusted key can use attacker-controlled claims to get unauthorized access.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","jwt","hashicorp-cap"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authorization decisions made on unvalidated claim values","analyst_note":"","how_to_check":"- Check the cap version your Go module uses, for example with `go list -m github.com/hashicorp/cap`\n- Look for `github.com/hashicorp/cap` in `go.mod` and `go.sum`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["cap-not-used","jwt-not-validated-by-cap"],"who_is_affected":"Applications that use the HashiCorp cap library to validate JWTs and make authorization decisions from the claims. Exposure needs a JWT signed by a key the application trusts and attacker-controlled claims in that token. Services that do not use cap for JWT validation can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000725,"input_tokens":4634,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-19194':15A,18A,124C '-2026':14A,17A,123C '0.14.0':32B,79C,129C 'access':70B 'applic':91C,119C 'attack':9A,52B,64B,106C 'attacker-control':63B,105C 'author':11A,40B,94C 'bypass':7A,86C 'canon':48B 'cap':2A,22B,27B,73C,128C 'caus':89C 'check':12A 'claim':5A,36B,49B,66B,84C,97C,108C 'code':39B 'control':65B,107C 'cve':13A,16A,122C 'decis':95C 'differ':43B,99C 'downstream':38B,90C 'exploit':103C 'fix':126C 'get':68B 'go':19B 'hashicorp':1A,21B,26B,72C 'hashicorp-cap':20B 'hold':53B 'jwt':3A,23B,28B,55B,74C,111C 'key':60B,115C 'let':8A 'librari':4A,30B,76C 'make':93C 'may':88C 'name':50B 'non':47B 'non-canon':46B 'one':35B 'packag':24B 'pass':10A 'requir':104C 'sign':56B,112C 'trust':59B,116C 'unauthor':69B 'use':41B,62B,96C 'valid':6A,29B,34B,75C,85C,102C 'valu':44B,98C 'version':78C 'via':45B 'vulner':81C,121C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the HashiCorp cap library to validate JWTs and make authorization decisions from the claims. Exposure needs a JWT signed by a key the application trusts and attacker-controlled claims in that token. Services that do not use cap for JWT validation can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["go","hashicorpcap","jwt","medium","package"],"campaign_type":null,"search_a":"'-19194':15A,18A '-2026':14A,17A 'attack':9A 'author':11A 'bypass':7A 'cap':2A 'check':12A 'claim':5A 'cve':13A,16A 'hashicorp':1A 'jwt':3A 'let':8A 'librari':4A 'pass':10A 'valid':6A","search_b":"'0.14.0':32B 'access':70B 'attack':52B,64B 'attacker-control':63B 'author':40B 'canon':48B 'cap':22B,27B 'claim':36B,49B,66B 'code':39B 'control':65B 'differ':43B 'downstream':38B 'get':68B 'go':19B 'hashicorp':21B,26B 'hashicorp-cap':20B 'hold':53B 'jwt':23B,28B,55B 'key':60B 'librari':30B 'name':50B 'non':47B 'non-canon':46B 'one':35B 'packag':24B 'sign':56B 'trust':59B 'unauthor':69B 'use':41B,62B 'valid':29B,34B 'valu':44B 'via':45B","search_c":"'-19194':124C '-2026':123C '0.14.0':79C,129C 'applic':91C,119C 'attack':106C 'attacker-control':105C 'author':94C 'bypass':86C 'cap':73C,128C 'caus':89C 'claim':84C,97C,108C 'control':107C 'cve':122C 'decis':95C 'differ':99C 'downstream':90C 'exploit':103C 'fix':126C 'hashicorp':72C 'jwt':74C,111C 'key':115C 'librari':76C 'make':93C 'may':88C 'requir':104C 'sign':112C 'trust':116C 'use':96C 'valid':75C,85C,102C 'valu':98C 'version':78C 'vulner':81C,121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T21:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@hashicorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19194","severity":null,"published_at":"2026-11-13T22:17:25+00:00","modified_at":"2026-11-13T22:17:25+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null}],"documents":[{"id":150271,"url":"https://discuss.hashicorp.com/t/hcsec-2026-60-cap-jwt-claims-validation-bypass-using-non-canonical-claim-names/78258","title":"HashiCorp security: HCSEC-2026-60 - CAP JWT claims validation bypass using non-canonical claim names","kind":"vendor","source":"vendor","publisher":null,"text":"HCSEC-2026-60 - CAP JWT claims validation bypass using non-canonical claim names\n\nBulletin ID: HCSEC-2026-60 Affected Products / Versions: cap/jwt up to 0.13.0; fixed in 0.14.0. Publication Date: November 13, 2026 Summary The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0. Background The cap library provides JWT signature verification and claims validation for Go applications. Applications can configure expected issuer and subject values to constrain which tokens they accept before using the returned claims. Details The library could interpret registered claims differently during validation and when returning them to the application. An attacker able to control token contents through a compromised or misconfigured trusted identity provider could potentially exploit this inconsistency to bypass configured issuer or subject expectations. The security impact depends on how the consuming application uses the returned claims. No unauthorized access has been demonstrated in Vault, Boundary, or other downstream applications. Applications that do not configure Expected.Subject or Expected.Issuer are not affected by the bypass of those respective checks. Remediation Customers should evaluate the risk associated with this issue and consider upgrading their cap dependency to version 0.14.0 or later. Acknowledgement This issue was reported to HashiCorp by anaximand3r and doyensec-mohamed. We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security . 1 post - 1 participant Read full topic","published_at":"2026-11-13T21:16:59+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}