{"id":"CVE-2026-65625","kind":"vulnerability","aliases":["CVE-2026-65625"],"related":[],"title":"jose (Erlang): truncated AES-GCM tag lets forged JWE ciphertexts pass","description":"The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds.\n\nThis issue affects jose: from 1.2.0 before 1.11.13.","summary":"The pure-Erlang AES-GCM fallback in jose accepts an attacker-truncated authentication tag, checking only as few as 8 bits. An attacker who controls a JWE token can forge ciphertext that is accepted as authentic within about 256 attempts, without the key; an oversized tag instead crashes the decrypting process.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","erlang","fips","jose","jwe","package"],"not_affected_if":["jose-1.11.13-or-later","native-aes-gcm","no-jwe-decryption"],"how_to_check":"- Check the installed jose version in the Erlang project's `rebar.lock` or `mix.lock`, or run `rebar3 tree | grep jose`; affected versions are from `1.2.0` before `1.11.13`.\n- Check whether the runtime uses a native crypto NIF for AES-GCM: the fallback is used when AES-GCM is not provided by a native crypto NIF, for example on FIPS, stripped or older OTP builds.","fix":"- Upgrade jose to `1.11.13` or later.","status":"open","published_at":"2026-10-26T20:17:57+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:52+00:00","updated_at":"2026-10-26T20:51:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T20:51:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade jose to `1.11.13` or later.","reach":"internet","title":"jose (Erlang): truncated AES-GCM tag lets forged JWE ciphertexts pass","impact":"medium","summary":"The pure-Erlang AES-GCM fallback in jose accepts an attacker-truncated authentication tag, checking only as few as 8 bits. An attacker who controls a JWE token can forge ciphertext that is accepted as authentic within about 256 attempts, without the key; an oversized tag instead crashes the decrypting process.","category":"package","nicknames":[],"who_cares":["erlang","elixir","jose","jwe","fips"],"confidence":0.8,"needs_auth":"no","worst_case":"forged encrypted tokens are accepted as authentic; decrypting process can crash","analyst_note":"","how_to_check":"- Check the installed jose version in the Erlang project's `rebar.lock` or `mix.lock`, or run `rebar3 tree | grep jose`; affected versions are from `1.2.0` before `1.11.13`.\n- Check whether the runtime uses a native crypto NIF for AES-GCM: the fallback is used when AES-GCM is not provided by a native crypto NIF, for example on FIPS, stripped or older OTP builds.","needs_analyst":false,"not_affected_if":["native-aes-gcm","no-jwe-decryption","jose-1.11.13-or-later"],"who_is_affected":"Applications that decrypt JWE tokens with jose from `1.2.0` before `1.11.13`, where the AES-GCM fallback is in use rather than a native crypto NIF. Exposure matters most when the attacker can supply JWE tokens to the decrypting service; systems on a standard OTP build with native AES-GCM, or that never decrypt JWE input, are less exposed. Teams that only sign or verify JWS are not in the described path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":3621,"output_tokens":689,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128':183C '-2026':14A,17A '-65625':15A,18A '-8':186C '1.11.13':266C '1.2.0':264C '128':149C,216C '2':182C,185C '256':66B,197C '8':47B,168C,172C 'accept':35B,61B,193C 'ae':5A,30B,84C,90C,108C,239C 'aes-gcm':4A,29B,83C,238C 'affect':261C 'attack':38B,50B,102C,153C 'attacker-suppli':101C 'attacker-trunc':37B 'attempt':67B,198C 'authent':40B,63B,96C,162C,195C,205C 'badmatch':221C 'binary/1':123C 'bit':48B,98C,110C,138C,145C,150C,169C,173C,217C 'block':113C,133C 'build':258C 'bypass':210C 'caus':219C 'check':42B,126C,176C 'ciphertext':11A,58B,190C 'claus':111C 'compar':142C 'comput':136C 'control':52B,155C 'crash':75B,223C 'crypto':247C 'cve':13A,16A 'decrypt':77B,225C,235C 'decrypt/4':114C 'decrypt/6':134C 'deriv':91C 'elixir':19B 'erlang':2A,20B,28B,82C 'ever':175C 'exampl':250C 'fallback':32B,86C,228C 'fip':21B,252C 'forg':9A,57B,189C 'forgeri':179C,207C 'gcm':6A,31B,85C,109C,132C,240C 'guard':119C 'incom':116C 'instead':74B,218C 'integr':209C 'issu':260C 'jose':1A,22B,34B,88C,262C 'jwa':89C 'jwe':10A,23B,54B,157C,234C 'key':70B,203C 'knowledg':200C 'length':129C 'let':8A 'littl':166C 'longer':214C 'nativ':246C 'nif':248C 'number':93C 'older':256C 'otp':257C 'overs':72B 'packag':24B 'pass':12A 'path':236C 'process':78B,226C 'provid':243C 'public':233C 'pure':27B,81C 'pure-erlang':26B,80C 'reach':230C 'real':148C 'reduc':178C 'reliabl':192C 'resist':180C 'size':139C 'strip':254C 'suppli':103C,211C 'tag':7A,41B,73B,97C,104C,117C,151C,163C,206C,213C 'tbit':137C 'token':55B,158C 'truncat':3A,39B,160C 'verif':130C 'verifi':95C 'whenev':237C 'within':64B,196C 'without':68B,199C","nicknames":[],"mitigations":[],"who_affected":"Applications that decrypt JWE tokens with jose from `1.2.0` before `1.11.13`, where the AES-GCM fallback is in use rather than a native crypto NIF. Exposure matters most when the attacker can supply JWE tokens to the decrypting service; systems on a standard OTP build with native AES-GCM, or that never decrypt JWE input, are less exposed. Teams that only sign or verify JWS are not in the described path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65625","severity":null,"published_at":"2026-10-26T20:17:57+00:00","modified_at":"2026-10-26T20:17:57+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}