CVE-2026-5749: JWT Access Control in Fullstep V5

Successful exploitation of CVE-2026-5749 could lead to a significant compromise of data confidentiality. An attacker, having acquired a valid JWT, could interact with authenticated API resources as if they were a legitimate user. This could involve accessing sensitive data, modifying configurations, or performing other actions that would normally be restricted. The potential blast radius depends on the sensitivity of the API resources and the privileges associated with the acquired JWT. The ability to obtain a JWT without authentication bypasses standard security controls, making this a high-risk vulnerability.

1. Reserved2026-04-07
2. Published2026-04-22
3. EPSS updated2026-04-30

The primary mitigation for CVE-2026-5749 is to upgrade to a patched version of Fullstep. Unfortunately, the specific patched version is not provided. Until a patch is available, consider implementing temporary workarounds. These may include stricter API authentication policies, rate limiting on registration endpoints, and enhanced monitoring for suspicious JWT usage. Review and strengthen access control mechanisms within the API to limit the impact of a compromised JWT. After upgrading, confirm the fix by attempting to register without authentication and verifying that a JWT is not generated.