Improper JWT Signature Validation in SAP Security Services Library
Summary
CVE-2023-50422: Improper JWT Signature Validation in SAP Security Services Library. Affects com.sap.cloud.security:java-security across 2 version ranges.
< 2.17.0
>= 3.0.0, < 3.3.0
Fixed in 2.17.0 or 3.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The SAP BTP Security Services Integration Library is a Java library that provides security services integration for SAP Business Technology Platform (BTP) applications. It is used to authenticate and authorize users, manage access control, and enforce security policies. The library includes functionality for handling JSON Web Tokens (JWTs), which are used for secure communication between services. However, a vulnerability has been discovered in the library's JWT signature validation process, which could allow an unauthenticated attacker to escalate privileges within the application.
Vulnerability Detail
The vulnerability arises from improper JWT signature validation in the SAP Security Services Library. Under certain conditions, an attacker can exploit this vulnerability to obtain arbitrary permissions within the application. This could lead to unauthorized access to sensitive data, privilege escalation, and potential compromise of the entire application. The vulnerability has a CVSS score of 9.1, indicating a critical severity level.
How To Fix
Latest published version: 4.2.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.17.02.17.0 -
>= 3.0.0, < 3.3.03.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to upgrade to the patched version as soon as possible to mitigate the risk.
Conclusion
The improper JWT signature validation vulnerability in the SAP Security Services Library poses a critical risk to applications using the affected packages. It is crucial to upgrade to the patched versions (2.17.0 or 3.3.0) to mitigate the risk of privilege escalation and unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.sap.cloud.security:java-security →
FAQ
The impact of this vulnerability is an escalation of privileges within the application. An attacker can obtain arbitrary permissions, potentially leading to unauthorized access to sensitive data and compromise of the entire application.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is crucial to upgrade to the patched version to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely by an unauthenticated attacker.
You can find more information about this vulnerability in the CVE record: https://www.cve.org/CVERecord?id=CVE-2023-50422
References
Related vulnerabilities
Recent vulnerabilities recorded for com.sap.cloud.security:java-security.
