Request GitHub Advisory Database review for CVE-2026-44699 / GHSA-q843-6q5f-w55g

[Nadav0077]

Hi,

I’d like to request review/inclusion of the published GitHub Security Advisory for libjwt:

• Advisory: GHSA-q843-6q5f-w55g
• CVE: CVE-2026-44699
• Repository: https://github.com/benmcollins/libjwt
• Advisory URL: GHSA-q843-6q5f-w55g

Summary:

libjwt accepted an RSA JWK without an alg parameter as the verification key for HS256/HS384/HS512 tokens. In the OpenSSL backend, this caused HMAC verification to use a zero-length key, allowing an attacker to forge JWTs using only the public JWKS in affected configurations.

The advisory has been published in the repo.

Could the GitHub Advisory Database team please review it for inclusion/indexing in the advisory database?

Thanks.