CVE-2025-68925: Jervis Package Suffers from JWT Algorithm Confusion Vulnerability
Summary
CVE-2025-68925: Jervis Has a JWT Algorithm Confusion Vulnerability. Affects net.gleske:jervis versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jervis is an open-source tool designed to facilitate continuous integration and deployment workflows, particularly for GitHub repositories. It leverages JSON Web Tokens (JWT) for secure communication and authentication. However, the package has a vulnerability that arises from inadequate validation of JWT headers, specifically regarding the algorithm used for signing the tokens.
Vulnerability Detail
The vulnerability stems from the fact that the Jervis code does not validate that the JWT header specifies 'alg':'RS256'. This oversight can lead to JWT forgery, allowing unauthorized access or manipulation of data. While the severity is considered low for internal use, external users should treat it as moderate due to potential risks in broader systems.
How To Fix
Latest published version: 2.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, external users may consider using an alternate JWT library that enforces stricter validation of JWT headers until they can upgrade to the patched version of Jervis.
Conclusion
In summary, the Jervis package has a JWT algorithm confusion vulnerability that could lead to JWT forgery. Users are advised to upgrade to version 2.2 to mitigate this risk. For those unable to upgrade immediately, using an alternate JWT library is recommended.
See every vulnerability recorded for net.gleske:jervis →
FAQ
The vulnerability is a JWT algorithm confusion issue, where the application does not validate the algorithm specified in the JWT header.
If exploited, this vulnerability could allow attackers to forge JWTs, potentially leading to unauthorized access or data manipulation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Yes, upgrading to Jervis version 2.2 or later will patch the vulnerability by ensuring proper validation of JWT headers.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.gleske:jervis.
