Bug 2442687 (CVE-2026-25554)

Summary: CVE-2026-25554 opensips: OpenSIPS: Authentication bypass due to SQL injection in JWT processing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: lemenkov
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenSIPS. The auth_jwt module, when configured with db_mode and a SQL database backend, contains a SQL injection vulnerability in the jwt_db_authorize() function. This function extracts the tag claim from a JSON Web Token (JWT) without verifying its signature and directly incorporates the unescaped value into a SQL query. A remote attacker can exploit this by supplying a crafted JWT with a malicious tag claim, leading to manipulation of query results, bypass of JWT authentication, and impersonation of arbitrary identities.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2442706    
Bug Blocks:    

Description OSIDB Bzimport 2026-02-25 18:05:00 UTC 
OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities.
Comment 2 Peter Lemenkov 2026-02-25 19:31:10 UTC 
There is some misunderstanding. I believe 3.6.4 already contains a fix - https://github.com/OpenSIPS/opensips/commit/2ce53bf26ea2a37032f61db9c8d2a671ab969b22. I am building only a package for F-42 (it still affected).