CVE-2023-48223

CVE-2023-48223 is a medium-severity vulnerability affecting the fast-jwt library (versions prior to 3.3.2) that allows for JSON Web Token (JWT) algorithm confusion. Specifically, the library's public key matching mechanism fails to properly identify all common PEM formats for public keys, making applications vulnerable if they use RS256, a public key with a "BEGIN RSA PUBLIC KEY" header, and do not explicitly specify an algorithm during verification. An attacker can exploit this by crafting a malicious JWT signed with the victim application's public RSA key using the HS256 algorithm, leading to arbitrary payload acceptance. The CVSS score is 5.9 (Medium) due to a network attack vector and high integrity impact, but high attack complexity. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.