CVE-2026-25554

OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities.

• CWE-89

• https://github.com/OpenSIPS/opensips/commit/3822d33c1c6b25832fdd88da1d23eed74be55b05
• https://github.com/OpenSIPS/opensips/pull/3807
• https://opensips.org/
• https://opensips.org/pub/opensips/3.6.4/ChangeLog
• https://www.vulncheck.com/advisories/opensips-auth-jwt-sql-injection-enables-jwt-authentication-bypass

Published

Feb 25, 2026

Last Modified

Jul 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25548InvoicePlane is a self-hosted open source application for ma…9.1
• CVE-2026-25549Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-2555A weakness has been identified in JeecgBoot 3.9.1. This vuln…7.5
• CVE-2026-25550Seagull Software BarTender 2010, 2016, and 2019 contain an u…9.8
• CVE-2026-25551Seagull Software BarTender 2021 R1 through 12.0.1 contains a…7.8
• CVE-2026-25552Ghost CLI before 1.30.1 contains an IP spoofing vulnerabilit…3.7
• CVE-2026-25555OpenBullet2 through version 0.3.2 contains an authentication…9.8
• CVE-2026-25556MuPDF versions 1.23.0 through 1.27.0 contain a double-free v…7.5
• CVE-2026-25557Evoluted PHP Directory Listing Script through 4.0.5 contains…5.4
• CVE-2026-25558QloApps through 1.7.0 contains a stored cross-site scripting…4.8
• CVE-2026-25559OpenBullet2 through version 0.3.2 contains a path traversal …8.8
• CVE-2026-2556A security vulnerability has been detected in cskefu up to 8…6.3