Jervis Has a JWT Algorithm Confusion Vulnerability
Vulnerability
The code doesn't validate that the JWT header specifies "alg":"RS256".
Impact
Depending on the broader system, this could allow JWT forgery.
Internally this severity is low since JWT is only intended to interface with GitHub. External users should consider severity moderate.
Patches
Jervis patch will explicitly verify the algorithm in the header matches expectations and further verify the JWT structure.
Upgrade to Jervis 2.2.
Workarounds
External users should consider using an alternate JWT library or upgrade.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | net.gleske:jervis | < 2.2 | 2.2 |
References
- https://github.com/samrocketman/jervis/security/advisories/GHSA-5pq9-5mpr-jj85
- https://nvd.nist.gov/vuln/detail/CVE-2025-68925
- https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
- https://github.com/samrocketman/jervis
- https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249
- http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-347- Platform
- Java / Kotlin (Maven)
- Package
net.gleske:jervis- Disclosed
- 13.01.2026
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-5pq9-5mpr-jj85 - CC BY 4.0
Vulnerability history: net.gleske:jervis
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 01.2026 01.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 6
- Medium 1
Disclosures per year
- 2026: 7
-
Jervis Has a JWT Algorithm Confusion Vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.