Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
ueberauth guardian — Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L P N N N N H 8.2 .0028 20.8 —
AFFECTED
Product Versions Fixed
guardian 1.0.0 – —
guardian d65227145f72b290106c06cecbe42728fbf05fe2 – —
TIMELINE
Jun 17 Reserved by EEF
Aug 1 EXPLOIT PUBLISHED — CVE-2026-55735 (ueberauth guardian). Public exploit reference added.
Aug 1 Published (CNA: EEF)
Aug 6 EXPLOIT PUBLISHED — CVE-2026-55735 (ueberauth guardian). Public exploit reference added.
Description
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token.
Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature.
An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.
This issue affects guardian: from 1.0.0 before 2.4.1.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| June 17, 2026 | Reserved | Reserved by EEF |
| August 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-55735 (ueberauth guardian). Public exploit reference added. |
| August 1, 2026 | Published | Published (CNA: EEF) |
| August 6, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-55735 (ueberauth guardian). Public exploit reference added. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| ueberauth | guardian | — | 1.0.0 | — |
| ueberauth | guardian | — | d65227145f72b290106c06cecbe42728fbf05fe2 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-55735 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.