A critical authentication bypass vulnerability in dashbit nimble_zta allows unauthenticated attackers to impersonate arbitrary Cloudflare service tokens, posing a severe risk to Zero Trust security architectures.

The function verify_token/2 in lib/nimble_zta/cloudflare.ex fails to validate the boolean result of the JWT signature check, effectively allowing an unauthenticated attacker to supply a forged token that the application accepts as valid. By injecting a malicious JWT in the cf-access-jwt-assertion header, an attacker can successfully impersonate any service token.

This vulnerability carries a CVSS score of 9.3, reflecting its critical potential for unauthorized access. Because this flaw affects the Cloudflare Zero Trust authentication mechanism, successful exploitation could grant an attacker full access to protected internal resources, leading to significant data breaches or unauthorized system control. The ability for an unauthenticated attacker to bypass security controls entirely represents an immediate threat to organizational confidentiality and integrity.

Immediate Action: Update the dashbit nimble_zta package to version 0.1.3 or later to incorporate the necessary cryptographic signature verification logic.

Proactive Monitoring: Review application access logs for unusual cf-access-jwt-assertion header values or authentication attempts that deviate from expected service token patterns.

Compensating Controls: Implement strict Network Access Control (NAC) lists or IP filtering to restrict access to the affected application endpoints until the patch is fully deployed.

Public Exploit Available: Unknown

Given the critical nature of this authentication bypass and the high CVSS score, organizations using nimble_zta must prioritize updating to version 0.1.3 immediately. Failure to patch this vulnerability leaves the affected environment fully exposed to unauthorized access, as the flaw provides a trivial mechanism for attackers to circumvent identity verification.