CVE-2025-68925
Medium · 5.3Jervis Has a JWT Algorithm Confusion Vulnerability
CVSS
5.3
EPSS
0.2%
Published
Jan 13, 2026
CISA due date
—
The record
Depending on the broader system, this could allow JWT forgery. Internally this severity is low since JWT is only intended to interface with GitHub. External users should consider severity moderate.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | net.gleske:jervis | 0 | 2.2 |
Related vulnerabilities
- GHSA-5pq9-5mpr-jj85 Jervis Has a JWT Algorithm Confusion Vulnerability Same vulnerability
- GHSA-gxp5-mv27-vjcj Jervis's AES CBC Mode is Without Authentication Also affects net.gleske:jervis
- GHSA-c9q6-g3hr-8gww Jervis Has Weak Random for Timing Attack Mitigation Also affects net.gleske:jervis
- GHSA-36h5-vrq6-pp34 Jervis's Salt for PBKDF2 derived from password Also affects net.gleske:jervis
- GHSA-67rj-pjg6-pq59 Jervis Has a SHA-256 Hex String Padding Bug Also affects net.gleske:jervis
- GHSA-crxp-chh4-9ghp Jervis has Deterministic AES IV Derivation from Passphrase Also affects net.gleske:jervis
- GHSA-mqw7-c5gg-xq97 Jervis Has a RSA PKCS#1 Padding Vulnerability Also affects net.gleske:jervis
- CVE-2025-68704 Jervis Has Weak Random for Timing Attack Mitigation Also affects net.gleske:jervis