Skip to main content

Authorization Bypass Through User-Controlled Key

CVE-2025-24976

Medium
6.6/10

Summary

Distribution is a toolkit to pack, ship, store, and deliver container content. Systems running registry with token authentication enabled may be vulnerable to an issue in which token authentication allows an attacker to inject an untrusted signing key in a JSON web token (JWT). The issue lies in how the "JSON web key" (JWK) verification is performed. When a JWT contains a JWK header without a certificate chain, the code only checks if the KeyID (`kid`) matches one of the trusted keys, but doesn't verify that the actual key material matches. There is no way to work around this issue without patching if the system requires token authentication. This issue affects github.com/distribution/distribution/v3 versions 3.0.0-beta.1 through 3.0.0-rc.2.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-639 - Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References

Advisory Timeline

  • Published