Hardcode RS256 in Apple JWT verification to prevent algorithm confusion
fix: hardcode RS256 in Apple JWT verification to prevent algorithm confusion (#4652)
Hardcode RS256 in Apple JWT verification to prevent algorithm confusionabf53d-fix-hardcode-rs256-in-apple-jwt-verification-cve-2026-82454fixhardcode rs256 apple jwt verification prevent
Committed by AAtomical
commit message
fix: hardcode RS256 in Apple JWT verification to prevent algorithm confusion (#4652)
decodeAppleToken previously extracted the `alg` field from the
attacker-supplied JWT header and passed it to jwt.verify() as the sole
allowed algorithm. With jsonwebtoken v8 (which does not validate
key-algorithm type compatibility), an attacker can set alg=HS256 and
sign a forged token using Apple's publicly available RSA public key as
the HMAC secret — bypassing signature verification and impersonating
any Apple user (account takeover).
Fix: hardcode algorithms to ['RS256'] (the only algorithm Apple's
identity service uses) instead of trusting the token header.Editor assessment
This commit patches CVE-2026-82454. The subject states the remedy, hardcoding RS256 in Apple JWT verification to prevent algorithm confusion, which is a precise and imperative summary. The body explains the attack in enough depth to teach: decodeAppleToken trusted the alg value from an attacker-supplied header and handed it to jsonwebtoken v8 as the only permitted algorithm, so HS256 signed with Apple's public RSA key as an HMAC secret forged identities. It then states the fix, restricting algorithms to RS256 because that is what Apple uses. No scope is present despite an obvious auth surface, and there are no tests or footers, but the rationale is exemplary.