nimble_zta
Add Zero Trust Auth (ZTA) to web apps running in your private cloud
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 4
- Cadence
- ~3 months
- Last 12 months
- 4
Reach
- Stars
- 73
Details
- License
- Apache-2.0
- First release
- Nov 29, 2025
| Version | Released | |
|---|---|---|
0.1.3
patch
| ||
0.1.2
patch
1 CVE
CVE-2026-91187
EEF-CVE-2026-91187
GHSA-rj24-g8cc-g7g2
Sep 24, 2026
Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy
High
Network
Low
None
None
SummaryImproper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.
This issue affects nimble_zta: from 0.1.2 before 0.1.3. Proof of concept
ImpactThe attacker authenticates as an arbitrary Cloudflare service token without holding the Cloudflare signing key. The application receives the WorkaroundsDisable the Cloudflare authentication strategy. To keep the user identity strategy available, reject the service token requests yourself. Examine each request before you call ConfigurationsThe application must add Affected versions
0.1.2
Fixed in
0.1.3
References
Updated Sep 24, 2026 · Source: OSV.dev | ||
0.1.1
patch
| ||
0.1.0
initial
|